How to implement RLS and CLS using Onelake security in Lakehouse?

Hi JasleenKaur 

I replicated your scenario, 

a) Do I need to share that lakehouse as an item to Viewer account as without sharing, I cant see the lakehouse in Viewer account.

ANswer: Yes, you need to share the lakehouse with respective user and grant him as view access to respective workspace.

B) If yes, then what permission should I give while sharing as I tried giving Readall permission through SQL endpoint, but it should all tables in lakehouse explorer and SQL endpoint.

Answer: You no need to give any Readall permission through SQL endpoint, just you can Switch the SQL endpoint to User’s identity mode (instead of service principal) in your main workspace.

Pls follwo below steps

Step-1 - Granted only readdata role to one table (example tat_tb) from my main workspace to user called SP Babu

Step2: Granted him as Viewr role to workspace

Step 3: Here I shared the lakehouse with him without granting any role as per below screenshot. 

Step 4: Now go to SQL analytics endpoint settings under security--> chnage the acces from Delegated identity to useridentity 

Step 5: Now here If I see in SP Babu account he can be avble to see only tata_tb table in his SQL analytics endpoint.

Hope this helps you

Thank you!!

Did I answer your question? Mark my post as a solution!

Proud to be a Super User!

Hi JasleenKaur, I would advise you to also read the Get started with OneLake security article by Microsoft thoroughly.

Then try the steps that Vinodh247 is mentioning.

Some remarks, also for other users reading this post:

• Check the DefaultReader role in OneLake Security of the lakehouse and make sure the users on who you want to apply RLS/CLS are not a member of the DefaultReader role.
• Avoid granting users workspace permissions, as this would give them access to all Fabric items within that workspace. Instead, for report viewers, use org apps or the workspace app to share reports. This approach provides access to the reports only, without exposing other Fabric items in the workspace.
• OneLake security does not apply when using import mode, as queries run against the in-memory dataset, not against OneLake.

Hope this helps. If so, please give kudos 👍 and mark as Accepted Solution ✔️ to help others.