Forum Discussion

afbraga66's avatar
afbraga66
Icon for Helper III rankHelper III
9 months ago
Solved

One Lake Security implementation doubts

Hey,   So am trying to identify how to implement One Lake Security. The goal is to provided self-service for departments which will have each their own workspace, by allowing them access throught s...
governance
one lake
security
  • V-yubandi-msft's avatar
    V-yubandi-msft
    9 months ago

    Hi afbraga66 ,
    If you need RLS to function properly, ensure your queries are run through the SQL Endpoint.
    When using a notebook, use %sql for queries that require RLS, as standard Spark reads (spark.read) do not enforce it yet.

     

    Thanks for your time.

afbraga66's avatar
afbraga66
Icon for Helper III rankHelper III
9 months ago

Hello,
Thanks for your response.
What missing configs might I have so that the RLS doesn't work or to run sparks notebooks with it? Based on my inputs in the original post I thought I had it all done, but it doesn't work. Do you know of any guide or tutorial on how to set this up? I've been searching multiple things but so far was not able to find anything crystal clear.

Thanks you.

 

Best regards,

André

  • V-yubandi-msft's avatar
    V-yubandi-msft
    Icon for Community Support rankCommunity Support
    9 months ago

    Hi afbraga66 ,

    I understand why this might be confusing. OneLake Security is still in preview, and its interaction with workspace roles can seem inconsistent. Here are the main points to keep in mind.

    1. Contributors can bypass most OneLake Security restrictions. For RLS to take effect, ensure the SQL Analytics Endpoint is set to use the user’s identity; otherwise, queries use the workspace identity and ignore RLS.

    2. RLS should be defined at the table level, with users or groups assigned to those roles. Remember to include a base access role (like DefaultReader or a custom role), or users may not see any data. When testing RLS, use the Viewer role, as Contributors can override restrictions.

    3. Spark notebooks do not enforce RLS when using Spark APIs like spark.read. RLS and OneLake Security only apply when queries go through the SQL Endpoint, including %sql in notebooks. This explains why some blog examples worked they probably used Contributor with the SQL Endpoint.

     

    As this feature is still in preview, updates to RLS rules might take some time to take effect.

    Helpful Reference : Row-level security - Microsoft Fabric | Microsoft Learn

    Thank You.