OneLake data access (preview) - how to deactivate on a lakehouse?

[PhilPrentiss]

I tried using the preview Lakehouse feature "Manage OneLake data access" and quickly ran into an error when trying to create a DirectLake semantic model from Power BI Desktop.

Failed to save modifications to the server. Error returned: 'We cannot access the data source because the data source uses Fabric OneSecurity role-based access control, which is not supported in Direct Lake mode yet. Please deactivate OneSecurity integration for this data source or switch to a different data source that doesn't rely on OneSecurity. See https://go.microsoft.com/fwlink/?linkid=2215281 to learn more.

My quandary is I cannot find a mechanism to deactivate OneSecurity on the Lakehouse other than to recreate it.  Any ideas?

[v-hashadapu · Accepted solution]

Hi @PhilPrentiss , Thank you for reaching out to the Microsoft Community Forum.

Power BI's DirectLake mode currently does not support Lakehouses that have OneSecurity (role-based access control) enabled. DirectLake requires direct file-level access to Delta tables in OneLake but OneSecurity restricts that access, leading to the error you're seeing. Even with recent updates, DirectLake with OneSecurity is not fully supported across all configurations, especially when using SQL endpoints or preview features in Power BI Desktop. As of Microsoft's March 2025 update, DirectLake can support OneSecurity in limited scenarios, but this support depends on the endpoint type and Power BI version. If you're connecting through a Lakehouse SQL endpoint or using the Manage OneLake data access preview, that support likely doesn't apply yet.

Currently, there is no method to disable OneSecurity on an existing Lakehouse, Microsoft does not provide a UI or API option to remove it. The only way to work around this is to recreate the Lakehouse without OneSecurity enabled. During Lakehouse creation, make sure to leave the OneSecurity checkbox unchecked. Afterward, migrate your Delta tables using a Fabric notebook or PySpark script. Once the new Lakehouse is ready, reconnect your DirectLake semantic model in Power BI Desktop to point to this version without RBAC interference.

If recreating the Lakehouse is not feasible, your other option is to switch to Import or DirectQuery mode in Power BI. These modes support OneSecurity and will allow you to use the existing Lakehouse, but you’ll lose the performance benefits of DirectLake such as real-time queries and no data duplication.

If this helped solve the issue, please consider marking it 'Accept as Solution' so others with similar queries may find it more easily. If not, please share the details, always happy to help.
Thank you.

[rks]

I was having the exact same issue just now. I tried your workaround, but I cannot even find the checkbox to disable OneSecurity. I can only opt-in for the schema:

[PhilPrentiss]

From my experience, OneSecurity is disabled by default on a Lakehouse.  Pressing the Manage OneLake data access (preview) button in the lakehouse becomes irreversible.

[PhilPrentiss]

Is support for the scenario described (DirectLake with OneSecurity) once out of preview?  Or is it an idea in backlog?  What is the best channel/method for helping Microsoft prioritize this work?  The feature is somewhat fundamental to our planned Fabric build out.