topic Re: Granular lakehouse data security with Workspace Private Links in Data Engineering

Granular lakehouse data security with Workspace Private Links

KimMW — Mon, 19 Jan 2026 13:33:07 GMT

Good afternoon!

The Workspace-level private links documentation says that it doesn't support Item sharing or OneLake Security (https://learn.microsoft.com/en-us/fabric/security/security-workspace-level-private-links-support). Is there any way to enforce RLS/CLS on access to Lakehouse data in a scenario where workspace-level private links are in use?

Thanks

Kim

Re: Granular lakehouse data security with Workspace Private Links

tayloramy — Mon, 19 Jan 2026 14:34:04 GMT

Hi @KimMW,

Right now there is no nice way to enforce RLS with private links.

OneLake Security isn't currently supported when a workspace-level private link is enabled for a workspace.

It does appear that the private link will work with the SQL Endpoint:

Supported scenarios for workspace private links - Microsoft Fabric | Microsoft Learn

But that would not work when working in Notebooks or anything that accesses the data through OneLake.

Re: Granular lakehouse data security with Workspace Private Links

deborshi_nag — Mon, 19 Jan 2026 14:38:00 GMT

Hello @KimMW

Yes, however, OneLake Security cannot be applied directly within the Lakehouse when using workspace-level private links.

RLS/CLS enforcement at the Lakehouse storage layer is not possible in this scenario, as OneLake Security is unsupported with workspace-level private links.

Microsoft has highlighted this restriction as you rightly mention:

Workspace-level private links do not support OneLake Security (which includes RLS and CLS), meaning item-level and table-level access controls are not enforced at this layer.

Consequently, OneLake Security RLS/CLS will not be effective if your configuration relies on private links.

Nonetheless, RLS at the model layer remains fully operational, as:

RLS within Semantic Models (Direct Lake / Import / DirectQuery) is managed by the Power BI engine, rather than OneLake.
This approach is recommended when OneLake Security is unavailable or not preferred, such as when workspace private links are in use.

This aligns with Microsoft’s guidance for implementing RLS in supported Fabric engines, including SQL Analytics Endpoint and semantic models.

Row-level security - Microsoft Fabric | Microsoft Learn

Hope this helps - please appreciate by leaving a Kudos or accepting as a Solution!

Re: Granular lakehouse data security with Workspace Private Links

KimMW — Mon, 19 Jan 2026 14:38:27 GMT

Thank you for confirming @tayloramy

Given that item sharing isn't supported with Workspace Private Link, how can one use the SQL Endpoint in these scenarios to give access in this way? Does the user have to have been granted access directly to the workspace the lakehouse is in?

Re: Granular lakehouse data security with Workspace Private Links

tayloramy — Mon, 19 Jan 2026 14:40:27 GMT

Hi @KimMW,

Yes, I do believe that workspace access needs to be granted.