OneLake Shortcut access - Item's owner access

[govindarajan_d]

Hi All,

If someone creates a Lakehouse and then adds shortcut to it, I understand that the item's owner role is used for getting data from that shortcut. 

But if that user moves out of the organization, then the connection breaks right, so what is the best way to deal with creating items and shortcuts?

[frithjof_v]

Possibly related idea: https://ideas.fabric.microsoft.com/ideas/idea/?ideaid=c507598c-0f44-ef11-b4ad-000d3a02b6d0

Please vote / comment on the idea to highlight the need.

Edit:

I also created some ideas related to the topic. Please vote:

Here is a generic Fabric idea related to this topic: https://ideas.fabric.microsoft.com/ideas/idea/?ideaid=4cb25a68-7d4d-ef11-b4ac-000d3a0e6066

And yes, why not have option for multiple owners of an item? https://ideas.fabric.microsoft.com/ideas/idea/?ideaid=0acce98c-7e4d-ef11-b4ac-000d3a0e6066 

Or just let the Workspace own the items, so it's not related to a user account.

https://ideas.fabric.microsoft.com/ideas/idea/?ideaid=1a2d3ce6-7d4d-ef11-b4ac-000d3a0e6066

[Anonymous]

Hi @govindarajan_d ,

It is not allowed to define permissions on the shortcut itself, I define permissions at the lakehouse level.

Select the lakehouse that shortcut belongs to and then select manage permissions to add users to grant permissions.

You also have the option of recreating a lakehouse and shortcut.

Best Regards,
Yang
Community Support Team

If there is any post helps, then please consider Accept it as the solution  to help the other members find it more quickly.
If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

[govindarajan_d]

Hi @Anonymous ,

In my understanding, RBAC roles do not affect how the shortcut works when it is accessed in this context. RBAC is more for providing access to particular items. 

Let's say I have a Lakehouse A and I add it as a shortcut to Lakehouse B. While I can give access for shortcut to others using RBAC, the shortcut works by using the Lakehouse owner's access everytime. So if the Lakehouse owner leaves the org, the RBAC part doesn't matter here. It is going to break the connection. 

[Anonymous]

Hi @govindarajan_d ,

Yes, so in my latest reply I didn't discuss the RBAC part, but expanded on how to grant permissions.

If you have any further questions please feel free to contact me.

Best Regards,
Yang
Community Support Team

If there is any post helps, then please consider Accept it as the solution  to help the other members find it more quickly.
If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

[Anonymous]

Hi @govindarajan_d ,

The owner role of a project is used to access data from OneLake shortcuts. This can indeed cause connectivity issues if the owner leaves the organization.

I have some suggestions for securing and managing OneLake shortcuts:

1. Multiple owners can be assigned to ensure that shortcuts have multiple owners.

2. implement RBAC to manage permissions. oneLake data access roles are a new feature that can be used to apply role-based access control (RBAC) to data stored in OneLake. You can define security roles that grant read access to specific folders in a fabric item and assign them to users or groups.

More information about RBAC can be found in the official documentation below:

Secure and manage OneLake shortcuts - Microsoft Fabric | Microsoft Learn

If you have any further questions please feel free to contact me.

Best Regards,
Yang
Community Support Team

If there is any post helps, then please consider Accept it as the solution  to help the other members find it more quickly.
If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

[govindarajan_d]

Hi @Anonymous , 

1. How can multiple owners be assigned to an object? Can you please explain?

2. RBAC is for different purpose. I am not looking to provide access but rather the way shortcut is designed, it uses item owner's permission. RBAC wouldn't solve this problem