Forum Discussion
Column Level OneLake Security - Not Working with shortcuts
Good Afternoon,
I'm looking to grant users access to tables from a central lakehouse, but for them to access them from their own lakehouses via shortcuts. Essentially a hub and spoke model, and something that Microsoft advertise as being a flagship capability of OneLake security.
The Source (central) lakehouse is configured with OneLake security enabled. A role has been created granting the users read access to 4 tables, and another 3 which have Column Level Security enabled.
In the user lakehouse I have created shortcuts referencing the tables in the source lakehouse. (I have set up both schema and table shortcuts to test both)
From the lakehouse view of the user lakehouse they can see the shortcuts, and can see data from the 4 tables that do not have CLS enabled, but get an error when trying to access tables with CLS enabled (even if no columns suppressed).
Anyone got any advice on what the issue could be?
Hi JonBFabric ,
Column-Level Security (CLS) is currently supported only when data is accessed directly from Fabric Lakehouses.
When the same data is accessed via OneLake shortcuts, CLS does not get enforced.This is a known product limitation, not a configuration issue.
To help prioritize this feature, it would be great if you could raise feedback / a feature request through the Microsoft Fabric feedback channel. Product teams actively track requests there, and it helps drive roadmap decisions. I’d encourage you to submit your detailed feedback and ideas via Microsoft's official feedback channels, such as the Microsoft Fabric Ideas.
Feedback submitted here is often reviewed by the product teams and can lead to meaningful improvement.
Thanks,
prashanth
MS Fabric Support
10 Replies
Hi JonBFabric ,
Column-Level Security (CLS) is currently supported only when data is accessed directly from Fabric Lakehouses.
When the same data is accessed via OneLake shortcuts, CLS does not get enforced.This is a known product limitation, not a configuration issue.
To help prioritize this feature, it would be great if you could raise feedback / a feature request through the Microsoft Fabric feedback channel. Product teams actively track requests there, and it helps drive roadmap decisions. I’d encourage you to submit your detailed feedback and ideas via Microsoft's official feedback channels, such as the Microsoft Fabric Ideas.
Feedback submitted here is often reviewed by the product teams and can lead to meaningful improvement.
Thanks,
prashanth
MS Fabric Support
Hello JonBFabric
Microsoft has made it clear that when CLS is implemented:
“Tables with CLS rules applied cannot be accessed outside of supported Fabric engines.”
Column-level security - Microsoft Fabric | Microsoft Learn
Shortcuts serve as a downstream means of access, but the engine used by the lakehouse viewer may be deemed “unsupported” depending on the circumstances—even if the user has the necessary permissions.
For this reason, non-CLS tables remain accessible, whereas CLS tables will generate an error.
Hi,
Whilst there are incompatabilities that I am aware of, I made it clear in my question that the user was accessing their lakehouse directly, specifically they were using the data preview feature. I can also confirm that the same is observed when trying to query the lakehouse from a Spark notebook. The link you shared explicitely states that this should work:
"Filtered tables in Fabric engines: Queries to the Fabric engines, like Spark notebooks, result in the user seeing only the columns they're allowed to see per the CLS rules."
Hi JonBFabric,
At the moment, Lakehouse security supports only workspace, schema, and table-level access through OneLake security. There is no engine-level interception when data is accessed via shortcuts, so Column-Level Security (CLS) cannot be evaluated or enforced there.
If CLS is a requirement, you would need to implement it at Fabric Warehouse / SQL Endpoint (using T-SQL). As a workaround (not recommended), you could create separate tables with different column-level granularity and expose them via shortcuts to different user lakehouses. This works, but introduces duplication and maintenance overhead.
That said, could you please share where and how did you apply CLS to those three tables, since I don't recall an existing feature to apply CLS directly at the Lakehouse level.
Good Morning stoic-harsh ,
This link details CLS implementation directly on a Lakehouse, as part of the Onelake Security implementation.
Hi JonBFabric the problem is with your shortcuts, nothing to do with the Filtered tables in Fabric engines. Only passthrough mode is supported on OneLake shortcuts, i.e OneLake security is not applicable.
Please read this Microsoft doc.
Understanding OneLake Security with Shortcuts | Microsoft Fabric Blog | Microsoft Fabric
Passthrough, as opposed to delegated, mode is what Shortcuts use.
From the link you shared:
"OneLake shortcuts utilize the passthrough auth model. In this model, the shortcut accesses data in the target location by ‘passing’ the user’s identity to the target system. This ensures that any user accessing the shortcut is only able to see whatever they have access to in the target. In this sense, the security from the target ‘flows across’ the shortcut to restrict access in the source lakehouse."
Also from Microsoft documents:
"When a user accesses data from another OneLake location through a shortcut, OneLake uses the identity of the calling user to authorize access to the data. This user must have permissions in the target location to read the data." Unify data sources with OneLake shortcuts - Microsoft Fabric | Microsoft Learn
For avoidance of doubt the data in the tables without CLS is accessible accross the shortcut, based on role access defined in OneLake Security.
The reference to Filtered tables in Fabric engines was in relation to your prior assertion that I was using an unsupported engine, which I am not.
Hi JonBFabric ,
Simply put, the Lakehouse UI’s underlying preview mechanism doesn't support column‑level security over shortcut passthrough.
Does anyone have real world experience, or inside knowledge, relating to using CLS with shortcuts?
