Fabric link to Dataverse - Dataverse security not copied over to lakehouse

[Marko33]

Hi there,

I have enabled the Fabric link to dataverse from our D365 CRM dataverse tables. I was expecting that the security concept will be taken over to the lakehouse, which obviously is not the case.

That means in our case, that a user who is assigned to a specific business unit in CRM, would see in the lakehouse the data of all business units.

Has anybody already solved this kind of problem?

Thanks,
Marko

[v-menakakota]

Hi @Marko33 ,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[v-menakakota]

Hi @Marko33 ,

Thank you for reaching out to us on the Microsoft Fabric Community Forum.

As mentioned, when linking Dataverse to Microsoft Fabric, the security model does not automatically carry over, and there's no native way to replicate the complex security structures such as business units and row-level security (RLS) directly. However, @nilendraFabric  suggestions are great ways to achieve similar behavior in the Fabric lakehouse.
Although these workarounds don’t fully automate the transfer of security from Dataverse to the lakehouse, they offer a reliable way to manage access control and ensure that users only have visibility into the data they’re authorized to see, based on their business unit or role.

If this post was helpful, please give us Kudos and consider marking Accept as solution to assist other members in finding it more easily.

Regards,
Menaka.

[nilendraFabric]

Hello @Marko33 

When linking Dataverse to Microsoft Fabric, the security model from Dataverse is not automatically replicated in the lakehouse. This means that the row-level security and business unit restrictions that exist in Dataverse are not enforced in the Fabric lakehouse by default. 

Security Model Differences

1. Dataverse uses a complex security model with business units, security roles, and row-level security
2. The Fabric lakehouse, on the other hand, has its own security model that doesn't directly map to Dataverse's structure

It means there is no direct way at the moment to migrate the security model from Dataverse.  But you can try mimicking the behavior by 

 

Define RLS roles that correspond to your Dataverse business units

Create views or stored procedures in the Fabric SQL endpoint that filter data based on the user's business unit

Use AAD groups that mirror your Dataverse business unit structur

Hope this makes sense.

Please accept this answer if this is helpful and give kuods.

[Marko33]

Hi @nilendraFabric, thanks for your answer.

When you say define RLS roles, where they need to be defined? I think it is only possible if I create a dedicated Warehouse, or is there any other suggestion?

[nilendraFabric · Accepted solution]

Hello @Marko33 

RLS is applied at the database tier, specifically in the Fabric Warehouse or SQL analytics endpoint.

While a dedicated Warehouse provides a centralized and scalable environment for implementing RLS, you can also define RLS on the SQL analytics endpoint linked to a Lakehouse. Both options support RLS configurations

https://techcommunity.microsoft.com/blog/analyticsonazure/microsoft-fabric-row-level-security-rls--c...

Please accept this solution this it answered the question