Permissions in all workspaces

as of today this is largely an API-driven problem, not a fully governed platform feature yet. There is no scalable way in the Fabric UI to bulk assign OneLake item-level permissions across many workspaces; UI works only per item. Notebooks can help, but only as a wrapper over REST calls. So practically you will need to use the Fabric REST APIs (or PowerShell) to iterate workspaces and items and grant the Purview managed identity Read access at the OneLake security layer.

For automation, there is no native “auto-grant on creation” for OneLake security yet. The common pattern is to build an event driven or scheduled job (for example using Fabric APIs+azure Func or a pipeline) that detects new workspaces/items and applies the permission. Some teams also enforce this via workspace provisioning pipelines where permissions are applied as part of creation.

For governance, there is currently no tenant-level policy in fabric/purview that enforces OneLake item permissions automatically. You can approximate it using AAD groups (assign purview identity via group and reuse it), combined with provisioning automation and naming/creation standards, but true policy-based enforcement at platform level is not available yet.

Hello fabricpribeiro,

Your understanding is correct. OneLake Security is evaluated independently of Workspace permissions, so having Viewer access alone isn't sufficient when OneLake Security is enabled.

To answer your questions:

1. Bulk permission assignment

   • At present, there isn't a native option in the Fabric UI to grant OneLake Security permissions across multiple workspaces or items in bulk. The recommended approach is to automate it using the Fabric REST APIs or a PowerShell/script-based solution.

2. Automatic permission assignment

   • As far as I'm aware, there isn't currently a built-in mechanism to automatically grant OneLake Security permissions to a service account whenever new workspaces or items are created. This would typically require an automation process that detects new resources and applies the required permissions.

3. Platform-level policy

   • Currently, there isn't a tenant-level policy to enforce OneLake Security permissions for all new items. Governance needs to be implemented through automation and operational processes rather than a built-in platform policy.

For environments with many workspaces, I'd recommend using an automated provisioning process (via the Fabric APIs) to apply the required OneLake Security permissions consistently whenever new Lakehouses or other secured items are created.

Best regards,
Omkar Shinde
Microsoft Fabric Enthusiast | Power BI Consultant

💡 If you found this response helpful, please consider giving it a Kudos.
✅ If this resolves your question, please mark it as the Accepted Solution to help others in the community.

Hi fabricpribeiro, 

This is where the Purview Unified Catalog falls apart with its Fabric integrations. There are APIs to add users to OneLake Security, but it's one API call per lakehouse and you need to define the role to give to the user, so there's no easy "add me to everything" button. 

See https://learn.microsoft.com/en-us/rest/api/fabric/core/onelake-data-access-security

There's no way to automatically enforce this, it needs to be done manually on every lakehouse that uses OneLake Security. 

Hi Pedro,

The only reliable way to solve this at scale is to automate OneLake Security assignment using the Fabric REST API.

Solution:

1. Create a service principal (or use Purview managed identity)
2. Create an Entra ID security group (e.g., “Purview-OneLake-Readers”)
3. Add the Purview identity to this group
4. Use Fabric REST API to assign OneLake “Read” access of that group to:
   • all existing Lakehouses / Warehouses
5. Run an automated job (Azure Function or scheduled script) that:
   • scans all workspaces
   • detects new items
   • automatically applies the same OneLake permission

That’s it.

There is currently no UI-based bulk fix or tenant policy, so this automation is the only way to ensure:

• existing items are covered
• new items are automatically handled
• Purview scanning works consistently

Once this is in place, it becomes fully hands-off going forward.