Row-Level Security (RLS) with INLINE or SCHEMABINDING

[tan_thiamhuat]

Row-Level Security (RLS) with INLINE or SCHEMABINDING.. how do we decide whether to use INLINE or SCHEMABINDING?

https://learn.microsoft.com/en-us/fabric/data-warehouse/tutorial-row-level-security   here mentioned SCHEMABINDING but does Microsoft documentation and best practices specifically recommend INLINE for RLS predicates?

[Ugk161610]

Hi @tan_thiamhuat ,

For RLS in Fabric / SQL, the predicate must be an INLINE table-valued function. That’s the required format for a row-level security filter, and it allows the engine to treat the predicate as part of the main query plan.

SCHEMABINDING is a separate option, and it is generally recommended. When a security policy is created with schemabinding turned on (which is the default), the predicate function also has to be created with WITH SCHEMABINDING. This prevents accidental schema changes that could break or change the RLS logic.

So the usual guidance is:

• Use INLINE TVF → required for RLS.

• Use SCHEMABINDING → recommended for production, and often mandatory depending on the policy settings.

In short: use an inline function for the predicate, and apply schemabinding unless you have a specific development-time reason not to.

GopiKrishna

[tan_thiamhuat]

I come across one of the DP-700 question on this, so I am not sure which should I choose.

Litware, Inc. is a publishing company that has an online bookstore and several retail bookstores worldwide. Litware also manages an online advertising business for the authors it represents.

Existing Environment. Fabric Environment
Litware has a Fabric workspace named Workspace1. High concurrency is enabled for Workspace1.
The company has a data engineering team that uses Python for data processing.
Existing Environment. Data Processing
The retail bookstores send sales data at the end of each business day, while the online bookstore constantly provides logs and sales data to a central enterprise resource planning (ERP) system.

Litware implements a medallion architecture by using the following three layers: bronze, silver, and gold. The sales data is ingested from the ERP system as Parquet files that land in the Files folder in a lakehouse. Notebooks are used to transform the files in a Delta table for the bronze and silver layers. The gold layer is in a warehouse that has V-Order disabled.
Litware has image files of book covers in Azure Blob Storage. The files are loaded into the Files folder.

Existing Environment. Sales Data
Month-end sales data is processed on the first calendar day of each month. Data that is older than one month never changes.

In the source system, the sales data refreshes every six hours starting at midnight each day.

The sales data is captured in a Dataflow Gen1 dataflow. When the dataflow runs, new and historical data is captured. The dataflow captures the following fields of the source:

• Sales Date
• Author
• Price
• Units
• SKU

A table named AuthorSales stores the sales data that relates to each author. The table contains a column named AuthorEmail. Authors authenticate to a guest Fabric tenant by using their email address.

Existing Environment. Security Groups
Litware has the following security groups:
• Sales
• Fabric Admins
• Streaming Admins

Existing Environment. Performance Issues
Business users perform ad-hoc queries against the warehouse. The business users indicate that reports against the warehouse sometimes run for two hours and fail to load as expected. Upon further investigation, the data engineering team receives the following error message when the reports fail to load: “The SQL query failed while running.”

The data engineering team wants to debug the issue and find queries that cause more than one failure.

When the authors have new book releases, there is often an increase in sales activity. This increase slows the data ingestion process.

The company’s sales team reports that during the last month, the sales data has NOT been up-to-date when they arrive at work in the morning.

Requirements. Planned Changes
Litware recently signed a contract to receive book reviews. The provider of the reviews exposes the data in Amazon Simple Storage Service (Amazon S3) buckets.

Litware plans to manage Search Engine Optimization (SEO) for the authors. The SEO data will be streamed from a REST API.

Requirements. Version Control
Litware plans to implement a version control solution in Fabric that will use GitHub integration and follow the principle of least privilege.

Requirements. Governance Requirements
To control data platform costs, the data platform must use only Fabric services and items. Additional Azure resources must NOT be provisioned.

Requirements. Data Requirements
Litware identifies the following data requirements:

• Process the SEO data in near-real-time (NRT).
• Make the book reviews available in the lakehouse without making a copy of the data.
• When a new book cover image arrives in the Files folder, process the image as soon as possible.

You need to ensure that the authors can see only their respective sales data.  (Row-Level Security, RLS)
How should you complete the statement? To answer, drag the appropriate values the correct targets. Each value may be used once, more than once, or not at all. You may need to drag the split bar between panes or scroll to view content.

[Ugk161610]

Hi @tan_thiamhuat ,

Use SCHEMABINDING, compare the passed row value to the current user with USER_NAME(), and apply the policy to AuthorSales.

Short explanation : the table column (AuthorEmail) is passed into the inline TVF as @Author, the function checks it against the current principal (USER_NAME()), and SCHEMABINDING is recommended/required for stable RLS.

GopiKrishna

[tan_thiamhuat]

but isn't INLINE the recommended option for RLS because it integrates the predicate directly into the query execution plan, resulting in better performance? Microsoft documentation and best practices specifically recommend INLINE for RLS predicates.

[Ugk161610]

Hi @tan_thiamhuat ,

INLINE refers to the type of function used for the RLS predicate, and yes — RLS expects an inline TVF because it lets the optimizer fold the predicate directly into the query plan. That’s why you see INLINE called out as the recommended approach.

SCHEMABINDING is just an additional option you apply to the same inline function. It doesn’t replace INLINE or change how RLS works. It simply prevents underlying tables or columns from being altered in a way that might break the predicate later.

So in practice:

• The predicate should be an inline TVF → this is the normal and recommended pattern for RLS.

• SCHEMABINDING is added on top when you want stability and to avoid accidental schema changes.

That’s why examples often show both together: you still use INLINE for the function, and you also apply SCHEMABINDING as a safety measure.

GopiKrishna

[tan_thiamhuat]

so for the question above, we should put INLINE, correct?