Security (RLS & sensitivity labels)

[Sanyukti_Jain]

Has anyone implemented row-level security alongside sensitivity labels in a Fabric workspace? Curious how these two work together in practice and any gotchas to watch out for

[v-sshirivolu]

Hi @Sanyukti_Jain ,
Thanks for reaching out to Fabric Community Forum.

RLS and sensitivity labels in Microsoft Fabric work at different levels. Row-Level Security controls which rows a user can access when querying a semantic model based on defined roles and filters. Sensitivity labels (Microsoft Purview Information Protection) classify and protect data assets for governance, they do not replace RLS or filter data rows.

Access is evaluated in layers: workspace/item permissions determine access to the Fabric item, and if the user has access, RLS filters the data based on the configured security roles. If access restriction is required through labeling, it is handled through Protection policies for Fabric associated with the sensitivity label.

Key checks:

Verify workspace role and RLS role membership.

Multiple RLS role assignments can result in broader visible data because role filters can combine.

RLS is enforced for Viewer permissions; Admin, Member, and Contributor roles have higher workspace permissions and are not the typical RLS consumer scenario.

For label issues, verify labels are enabled, published to users/groups, and protection settings match the requirement.

Sensitivity label - data classification and protection/governance
RLS - row-level filtering inside the semantic model

Documents :
Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn
Information protection in Fabric - Microsoft Fabric | Microsoft Learn
Protection policies in Microsoft Fabric - Microsoft Fabric | Microsoft Learn

Thank you.

[v-sshirivolu]

Hi @Sanyukti_Jain  ,

I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We’re always here to support you

[Parchitect]

Hello!

Yes, but I would treat them as two different security/governance layers. We do implement both this capabilities.

RLS controls data access at the row level. For example, the same report can be used by multiple users, but each user only sees the rows they are allowed to see based on their role, region, department, customer, etc.
Users should only see rows depending on their region as example.

Sensitivity labels solve a different problem. They classify the sensitivity of the content, such as Internal, Confidential, or Highly Confidential, and can help protect the data when it is shared or exported. Depending on how the label is configured in Purview, exported files can inherit the label and protection, for example requiring organizational accounts to open the file and preventing access outside the organization. 

So I would not see labels as a replacement for RLS.

Mental model:

Workspace/item permissions = who can access the asset
RLS = which rows they can see
Sensitivity labels = how sensitive the content is and how it should be protected, especially when it leaves Fabric/Power BI

A few gotchas:
- Test RLS with real users or “View as” before production.
- Use Entra ID groups instead of assigning individual users.
- Be careful with Build permission on semantic models.
- Validate export scenarios like Excel, PowerPoint, PDF, and Analyze in Excel so that you can see that labels are inherited.
- Make sure the label policy matches the actual business sensitivity of the data. An information classification is made of the data, and we match correct labels for it.

In practice, they work well together: RLS limits what data the user sees, and sensitivity labels help classify and protect the content they are allowed to access. We enforced that labels must be applied, you can set the option togheter with Microsoft Purview. RLS is not enforced by default, its depending on the business requirements.

Best regards,

Parchitect - Solutions Architect

💡Did my response help you? Clicking Kudos is a small gesture that goes a long way!

✔️Did I answer your question? Please mark my post as a Solution to help others find it faster.