Clarification on Access Control for SQL Endpoints in Fabric Workspaces

Hi SwedishJAS you don't have to add any permissions at the workspace level if you need granular permissions for a SQL Endpoint.  To run through a scenario, if I had a user "User One" and I just wanted them to have read access on all tables in a particular SQL Endpoint I would

• Go to the Lakehouse/Warehouse and select Manage Permissions
• Select Add User and find the user/group e.g. User One
• At this stage I can select Read All SQL Endpoint Data

I could just leave this setting and click OK, then User One has access to the SQL Endoint I have granted.  I don't need to add User One at the workspace level.

If I want even more granular control I can:

• Go to the Lakehouse/Warehouse and select Manage Permissions
• Select Add User and find the user/group e.g. User One
• Do not select any options in the dialog box (this provides access called CONNECT)
• Then I can go into the SQL Endpoint and issue granular permissions like GRANT SELECT ON <object> TO User/Group

Hope this helps

Can you point me towards documentation/videos that state that users need to be added to Workspaces?  I have confirmed that adding users to a workspace is not required, I have tested this myself with both SSMS and browsing the OneLake catalog.

What version of SSMS are you using?

Hi SwedishJAS ,
I tried to reproduce your exact scenario and tried around various combinations of workspace roles and permissions to check how to connect to SQL endpoint without granting access to Workspace.

When i gave the user Read and ReadAll permission without giving any workspace role was able to connect to SSMS without any issue, faces the same issue as you while connecting with only Read permission.

Hope this helps you 

Did I answer your question? Mark my post as a solution, this will help others!

If my response(s) assisted you in any way, don't forget to give "Kudos"


Thanks and Regards