CustomGPT Fabric integration with RLS

Hi softbrendan 

To enforce Row-Level Security (RLS) when connecting a Custom GPT to Microsoft Fabric data, you must authenticate with a user-delegated OAuth token—not as a service principal or app-only app. RLS is only enforced when queries are made with the actual user’s identity (using OAuth 2.0 Authorization Code flow), typically through DAX or SQL endpoints such as the XMLA endpoint or SQL Analytics endpoint.

GraphQL endpoints do not enforce RLS, and app-only or service principal tokens will bypass RLS rules by design. The recommended approach is to have your Custom GPT authenticate as the user and query Fabric using their token; this allows Fabric to apply RLS as intended. For more details, see Enforce RLS for Direct Lake and XMLA endpoint and RLS in Microsoft’s documentation.