Need to secure a table - thoughts on how?

[Bshin]

Hey folks, I have a use case where we have some very secure data that only 3-4 users may have privilege to view (just Read). We cannot have anyone else in the organization/tenant view this table (all tables live in a Data Lakehouse). 

My team and I had several ideas on how to do this (such as creating a separate workspace for the 3-4 privlieged users, creating a new lakehouse just for the sensitive data, etc).

Just wanted the broader communities thoughts on how they would implement this. 

Thanks!

[v-prasare]

Hi @Bshin,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided for your issue worked? or let us know if you need any further assistance here?

@lbendlin & @nilendraFabric , Thanks for your promt response

Thanks,

Prashanth Are

MS Fabric community support

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly and give Kudos if helped you resolve your query

[nilendraFabric · Accepted solution]

Hello @Bshin 

OneLake Data Access Roles provide folder-level access control within your lakehouse:

1. Create a custom role for your sensitive data

2. Assign this role to the specific folder containing your sensitive table

3. Add only your 3-4 privileged users to this role

4. Ensure these users aren't also assigned to the DefaultReader role (which grants access to all folders)

https://data-mozart.com/understanding-data-access-options-in-microsoft-fabric/

• Be aware that implementing RLS, OLS, or CLS on the SQL analytics endpoint will cause Power BI queries in Direct Lake mode to fall back to Direct Query mode

• Users with write access (Admin, Member, Contributor roles) aren't restricted by OneLake data access roles - they retain full access to data in OneLake

• For complete isolation, consider creating a separate workspace for this sensitive data, as OneLake data access roles currently only apply to users accessing OneLake directly

[lbendlin]

There is lots of documentation on this topic. Please read through that

https://learn.microsoft.com/en-us/fabric/data-engineering/lakehouse-sharing

https://learn.microsoft.com/en-us/fabric/data-warehouse/security

https://databear.com/control-access-microsoft-fabric-lakehouse/

make sure to understand the difference between Lakehouse tables and Lakehouse SQL Endpoint tables.