Forum Discussion
RLS using EntraId groups on Warehouse
Hi Srisakthi ,
You can -
1.Use Entra ID Group Membership in SQL Endpoint RLS Policies
Define RLS policies at the SQL endpoint level using IS_Member('groupname') or similar functions.
This allows you to check if the current user belongs to a specific Entra ID group without needing that group listed in the table.
or use
2.Centralized Role Management via OneLake RBAC
OneLake RBAC (Role-Based Access Control) supports fine-grained access control at folder and file levels.
You can assign read/write permissions to Entra ID groups directly at the workspace or folder level, which cascades to the warehouse.
More about - One Lake Security
Additinally, you might want to check out-
Dynamic RLS with AD Security Groups
Hope this helps!
If the response has addressed your query, please accept it as a solution so that other members can easily find it.
Thank You!
Hi v-sdhruv
I've been trying to implement RLS using Entra ID groups on my Lakehouse table in SQL endpoint, but I'm running into issues.Here's what I tried:
CREATE FUNCTION Security.fnRLSGroupFilter(@UserPrincipalName AS VARCHAR(100))
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN
SELECT 1 AS AccessGranted
WHERE IS_MEMBER('ReaderFabricDemoGroup') = 1;
GO
I have also tried using @UserName
However, the policy doesn't seem to work as expected.
Can you share some sample scripts or working examples of RLS using Entra ID groups in Fabric lakehouse SQL Endpoint or Warehouse tables? It would be super helpful to see how others have approached this.
Thanks!Hi Shreya_Barhate ,
Thanks for your detailed exploration.
v-sdhruv I have even tried earlier it was not working. Shreya also shared her observation. Could you please share some samples on it.
Regards,
Srisakthi
