Forum Discussion

fabricator1's avatar
fabricator1
Advocate II
2 years ago

Direct Lake fallback to Direct Query due to SQL security?

Hi,

I am wondering if Direct Lake mode will keep working if I apply granular SQL access control (GRANT, DENY, REVOKE) on a SQL Analytics Endpoint or Data Warehouse?

I am also wondering if Direct Lake mode will keep working if I apply SQL Row Level Security on a SQL Analytics Endpoint or Data Warehouse?

 

Thanks! 😀

data engineering
data warehouse
power bi
security

6 Replies

  • Anonymous's avatar
    Anonymous
    Not applicable
    2 years ago

    Hi fabricator1 ,

    Thanks for using Fabric Community.

    The access restriction logic is in the database tier, not in any single application tier. The database applies the access restrictions every time data access is attempted, from any application or reporting platform including Power BI. This makes your security system more reliable and robust by reducing the surface area of your security system. Row-level security only applies to queries on a Warehouse or SQL analytics endpoint in Fabric. Power BI queries on a warehouse in Direct Lake mode will fall back to Direct Query mode to abide by row-level security.

    For more information, please refer here.

    Hope this is helpful. Please let me know incase of further queriues.

    • fabricator1's avatar
      fabricator1
      Advocate II
      2 years ago

      Thank you Anonymous!

       

      Power BI queries on a warehouse in Direct Lake mode will fall back to Direct Query mode to abide by row-level security.

      Does this also apply to the SQL Analytics Endpoint?

      How about when using SQL Granular Permissions (not RLS).
      Will that also make Direct Lake fallback to DirectQuery?
      If yes, will Direct Lake fall back to DirectQuery for all report users on that Warehouse / SQL Analytics Endpoint, or only for those users for whom SQL Granular Permissions have been defined?

      • Anonymous's avatar
        Anonymous
        Not applicable
        2 years ago

        Hi fabricator1 ,

        At this time, we are reaching out to the internal team to get some help on this .
        We will update you once we hear back from them.

  • ritz's avatar
    ritz
    Advocate I
    8 months ago

    Hello, 

    Here a year later because i'm having the same questions. Is there any documentation in the meantime regarding this?

     

    My use-case is applying RLS to a view in SQL analytics endpoint (granting SELECT to only a role with specific users assigned to that role), and then creating a semantic model with direct lake to that view.

     

    If I'm a user that's not on that role, in theory, when i check the semantic model, i should not see data in that view, right? This is what I need to confirm