Forum Discussion

JonBFabric's avatar
JonBFabric
Helper I
7 months ago
Solved

Column Level OneLake Security - Not Working with shortcuts

Good Afternoon,   I'm looking to grant users access to tables from a central lakehouse, but for them to access them from their own lakehouses via shortcuts. Essentially a hub and spoke model, and s...
data engineering
lakehouse
  • v-prasare's avatar
    v-prasare
    7 months ago

    Hi JonBFabric ,

    Column-Level Security (CLS) is currently supported only when data is accessed directly from Fabric Lakehouses.
    When the same data is accessed via OneLake shortcuts, CLS does not get enforced.

    This is a known product limitation, not a configuration issue.

     

    To help prioritize this feature, it would be great if you could raise feedback / a feature request through the Microsoft Fabric feedback channel. Product teams actively track requests there, and it helps drive roadmap decisions. I’d encourage you to submit your detailed feedback and ideas via Microsoft's official feedback channels, such as the Microsoft Fabric Ideas.

    Feedback submitted here is often reviewed by the product teams and can lead to meaningful improvement.

     

     

    Thanks,

    prashanth

    MS Fabric Support

deborshi_nag's avatar
deborshi_nag
Super User
7 months ago

Hello JonBFabric 

 

Microsoft has made it clear that when CLS is implemented:

“Tables with CLS rules applied cannot be accessed outside of supported Fabric engines.”

 

Column-level security - Microsoft Fabric | Microsoft Learn

 

Shortcuts serve as a downstream means of access, but the engine used by the lakehouse viewer may be deemed “unsupported” depending on the circumstances—even if the user has the necessary permissions.

For this reason, non-CLS tables remain accessible, whereas CLS tables will generate an error.

 

 

JonBFabric's avatar
JonBFabric
Helper I
7 months ago

Hi,

 

Whilst there are incompatabilities that I am aware of, I made it clear in my question that the user was accessing their lakehouse directly, specifically they were using the data preview feature. I can also confirm that the same is observed when trying to query the lakehouse from a Spark notebook. The link you shared explicitely states that this should work:

 

"Filtered tables in Fabric engines: Queries to the Fabric engines, like Spark notebooks, result in the user seeing only the columns they're allowed to see per the CLS rules."