Guidance on Securing Fabric Data Warehouse and Workspace Access

[Ayush05-gateway]

Hi Community,

I'm seeking advice on how to securely configure access to a Microsoft Fabric Data Warehouse and its associated workspace.

Business Context:
Business users with SQL and Power BI expertise would like to directly connect to the Fabric Data Warehouse for reporting and analysis.

Challenge:
In our current Synapse setup, we manage access by creating SQL users through SSMS and assigning roles that provide limited access to specific schemas and tables.

However, in Fabric Data Warehouse, this approach doesn’t fully meet our needs. To enable access, we must grant both Read/ReadAll  permissions at the Data Warehouse item level and Viewer permissions at the workspace level. This raises a concern: granting workspace-level access exposes users to other assets—such as pipelines and notebooks—which we prefer to keep restricted.

Our objective is to allow users to connect via SSMS, Power BI, or tools like Alteryx, with access limited strictly to authorized schemas and tables—without exposing other workspace artifacts.

Request:
I’d appreciate any solutions, best practices, or recommendations to enforce more granular, secure access to the Fabric Data Warehouse without compromising the overall workspace security.

Thanks in advance!

[Ayush05-gateway]

Thanks Nandan. it works now. Issue probably was with role which did not work. GRanting direct perms at AD level works. 

[NandanHegde · Accepted solution]

via manage permission, add the group at warehouse by deselecting all permissions and then execute the Grant select query.

The manage permission would give connect rights on the warehouse

[NandanHegde]

There is no need to grant viewer access at workspace level to grant read access on fabric warehouse.

You can grant access directly on fabric warehouse via Grant commands:

https://learn.microsoft.com/en-us/fabric/data-warehouse/sql-granular-permissions

[Ayush05-gateway]

Hi Nandan, thanks for your quick reply. Grant was provided but it did not help. Below were the commands executed, might help to find the issue.

GRANT select ON SCHEMA::GWODS TO db_PowerUser;
EXEC sp_addrolemember 'db_PowerUser', '<MS Entra AD Group>'

Where db_PowerUser is DB role and MS Entra AD Group is group created to manage users that need such access.