Security should be consistent wherever you query your data. With OneLake security, you can define access controls once, close to the data, and apply them across supported Microsoft Fabric engines without recreating your security rules for each experience.
Today, we’re announcing the general availability of OneLake security support for Eventhouse external tables. When these external tables query data secured by OneLake security, they automatically enforce object-level, column-level, and row-level access controls. This extends the same centrally managed security model to KQL queries, helping you maintain consistent, end-to-end security and governance across analytics experiences.
Lakehouse data with Eventhouse power
The Eventhouse endpoint for Lakehouses provides a high-performance query layer over data stored in the Lakehouse, bringing the speed and scale of the Eventhouse engine to your existing data without requiring another copy. Because access remains governed by OneLake security, users get Eventhouse performance while your organization maintains a shared, centrally managed security model across Fabric.
Object, column, and row level security
Eventhouse support covers three levels of access control, allowing you to tailor access to the data users need.
- Object-level security: Control which underlying OneLake tables a user can access. Creating an external table in Eventhouse does not grant access to the secured data it references.
- Column-level security: Limit access to sensitive columns. Users can analyze the data they’re permitted to access without gaining access to protected fields.
- Row-level security: Filter table data using the rules defined in your OneLake security roles. Users querying an external table receive only the rows they’re authorized to read.
These controls are applied automatically based on the querying user’s effective OneLake permissions. The external table provides a way to query the data and not a separate path around its security.
Figure: When the user queries the data through Eventhouse, only rows for “United States” are returned, based on the user’s OneLake security rules.
Get started
To get started, use OneLake security roles to define access to your OneLake tables, and then query the secured data through the Eventhouse endpoint. Test the experience with a representative data consumer to confirm that table access, column restrictions, and row filters match your intended policies.
For more information about defining access controls, refer to Table, column, and row-level security in OneLake.
With Eventhouse support for OneLake security, teams can use KQL to analyze Lakehouse data with Eventhouse performance while preserving centrally managed access controls across Fabric.
Microsoft Employee