Forum Discussion
Lakehouse table security
Hello schneiw, there is no Deny as of today; however, you can do that by leveraging One lake security preview.
To simplify the solution and maintenance undertaking, you can store GL data under one schema.
Then define a role to read data inside this schema.
add allowed user group as a member and then share the lakehouse with this group. when sharing the lakehouse, keep all selections unticked. By that, users will see the lakehouse under the OneLake catalog.
If you need to grant them SQL endpoint access, go to the SQL endpoint and switch to Use OneLake security for tables (User's identity access mode)
It's important to keep in mind that having higher-level rights (shared read All, or having workspace-level access) will override this security setup.
Hello schneiw,
No. SQL GRANT/DENY only works on the SQL Endpoint; notebooks access Delta tables directly, so those permissions aren’t enforced.
To restrict access (for example GL tables), move them to a separate Lakehouse and grant access only to the authorized group.
Docs: https://learn.microsoft.com/fabric/data-engineering/lakehouse-overview