Forum Discussion

JonBFabric's avatar
JonBFabric
Helper I
7 months ago
Solved

Column Level OneLake Security - Not Working with shortcuts

Good Afternoon,   I'm looking to grant users access to tables from a central lakehouse, but for them to access them from their own lakehouses via shortcuts. Essentially a hub and spoke model, and s...
data engineering
lakehouse
  • v-prasare's avatar
    v-prasare
    7 months ago

    Hi JonBFabric ,

    Column-Level Security (CLS) is currently supported only when data is accessed directly from Fabric Lakehouses.
    When the same data is accessed via OneLake shortcuts, CLS does not get enforced.

    This is a known product limitation, not a configuration issue.

     

    To help prioritize this feature, it would be great if you could raise feedback / a feature request through the Microsoft Fabric feedback channel. Product teams actively track requests there, and it helps drive roadmap decisions. I’d encourage you to submit your detailed feedback and ideas via Microsoft's official feedback channels, such as the Microsoft Fabric Ideas.

    Feedback submitted here is often reviewed by the product teams and can lead to meaningful improvement.

     

     

    Thanks,

    prashanth

    MS Fabric Support

stoic-harsh's avatar
stoic-harsh
Super User
7 months ago

Hi JonBFabric,

 

At the moment, Lakehouse security supports only workspace, schema, and table-level access through OneLake security. There is no engine-level interception when data is accessed via shortcuts, so Column-Level Security (CLS) cannot be evaluated or enforced there.

 

If CLS is a requirement, you would need to implement it at Fabric Warehouse / SQL Endpoint (using T-SQL). As a workaround (not recommended), you could create separate tables with different column-level granularity and expose them via shortcuts to different user lakehouses. This works, but introduces duplication and maintenance overhead.

 

That said, could you please share where and how did you apply CLS to those three tables, since I don't recall an existing feature to apply CLS directly at the Lakehouse level.