Granular lakehouse data security with Workspace Private Links

[KimMW]

Good afternoon!

The Workspace-level private links documentation says that it doesn't support Item sharing or OneLake Security (https://learn.microsoft.com/en-us/fabric/security/security-workspace-level-private-links-support). Is there any way to enforce RLS/CLS on access to Lakehouse data in a scenario where workspace-level private links are in use?

Thanks

Kim

[tayloramy · Accepted solution]

Hi @KimMW, 

Right now there is no nice way to enforce RLS with private links. 

• OneLake Security isn't currently supported when a workspace-level private link is enabled for a workspace.

It does appear that the private link will work with the SQL Endpoint: 

Supported scenarios for workspace private links - Microsoft Fabric | Microsoft Learn

But that would not work when working in Notebooks or anything that accesses the data through OneLake. 

[deborshi_nag · Accepted solution]

Hello @KimMW 

Yes, however, OneLake Security cannot be applied directly within the Lakehouse when using workspace-level private links.

RLS/CLS enforcement at the Lakehouse storage layer is not possible in this scenario, as OneLake Security is unsupported with workspace-level private links.

Microsoft has highlighted this restriction as you rightly mention:

• Workspace-level private links do not support OneLake Security (which includes RLS and CLS), meaning item-level and table-level access controls are not enforced at this layer. 

Consequently, OneLake Security RLS/CLS will not be effective if your configuration relies on private links.

Nonetheless, RLS at the model layer remains fully operational, as:

• RLS within Semantic Models (Direct Lake / Import / DirectQuery) is managed by the Power BI engine, rather than OneLake.
• This approach is recommended when OneLake Security is unavailable or not preferred, such as when workspace private links are in use.

This aligns with Microsoft’s guidance for implementing RLS in supported Fabric engines, including SQL Analytics Endpoint and semantic models.

Row-level security - Microsoft Fabric | Microsoft Learn

Hope this helps - please appreciate by leaving a Kudos or accepting as a Solution! 

[tayloramy · Accepted solution]

Hi @KimMW, 

Right now there is no nice way to enforce RLS with private links. 

• OneLake Security isn't currently supported when a workspace-level private link is enabled for a workspace.

It does appear that the private link will work with the SQL Endpoint: 

Supported scenarios for workspace private links - Microsoft Fabric | Microsoft Learn

But that would not work when working in Notebooks or anything that accesses the data through OneLake. 

[KimMW]

Thank you for confirming @tayloramy 

Given that item sharing isn't supported with Workspace Private Link, how can one use the SQL Endpoint in these scenarios to give access in this way? Does the user have to have been granted access directly to the workspace the lakehouse is in?

[tayloramy]

Hi @KimMW, 

Yes, I do believe that workspace access needs to be granted.