Lakehouse Column-Level-Security via OneLake Data Access Role

[stellahe102]

Hi there, we are experimenting with applying column level security to lakehouse tables.

we don't have the same feature shown in the official doc highlighted in below:

Below is what we are seeing on our end: no option for "Column security(Preview)." when going to the tables in the role. We know for sure one security role works for us, as users can only access the tables defined in the oneLake security role, but column security (Preview) or row security is not enabled.

Is this because this is a new feature, or is there something we need to do to enable this feature?

[v-pnaroju-msft]

Hi stellahe102,

Thank you for your update and for your patience.

Based on my understanding, it appears that the behaviour you are experiencing may be due to CLS still being in preview and not yet fully rolled out across all regions and tenants. Your configuration meets all the prerequisites, such as OneLake security being enabled and Delta tables being present, and no additional tenant or capacity configuration is required.
We request that you monitor the Microsoft Fabric blog for updates as the feature progresses toward general availability.

Microsoft Fabric Blog

We hope the information helps to clarify the situation. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Hi stellahe102,

We wanted to see if the information we gave helped fix your problem. If you need more help, please feel free to contact the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Hi stellahe102,

We are following up to see if what we shared solved your issue. If you need more support, please reach out to the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Thankyou, @AntoineW, for your response.

Hi stellahe102,

We would like to follow up and see whether the details we shared have resolved your problem.
If you need any more assistance, please feel free to connect with the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Thankyou, @tayloramy for your response.

Hi stellahe102,

We appreciate your inquiry through the Microsoft Fabric Community Forum.

Based on my understanding, Column Level Security (CLS) in OneLake is available only for Delta tables after OneLake security is enabled on the lakehouse. If the table is not a Delta-Parquet table (i.e., it does not contain a _delta_log folder), or if the SQL endpoint is not configured to use the user’s identity, the CLS option will not be displayed. Additionally, users who remain in the default role DefaultReader will continue to have full access, which can hide CLS behaviour.

Please follow the steps below, which may help to resolve the issue:

1. Open the lakehouse and select Manage OneLake security (preview) / Manage OneLake data access (preview) and ensure that it is enabled.
2. Confirm that the table is a Delta table. In Lakehouse Explorer, rightclick the table and select View files to check for the presence of _delta_log. If it is not a Delta table, reload or convert the data into a Delta table using Load to table or Spark write with format("delta").
3. If you plan to query via the SQL Analytics endpoint, switch OneLake access mode to User’s identity under Security.
4. Remove the test user from the DefaultReader role to validate the custom role permissions.
5. After completing the above steps, go to Manage OneLake security, open Roles, and under Data for the relevant role select the ellipsis (…), you should then see Column security (preview).

For further reference, please consult the following links:
Lakehouse sharing and permission management - Microsoft Fabric | Microsoft Learn
Get started with OneLake security (preview) - Microsoft Fabric | Microsoft Learn
Column-level security - Microsoft Fabric | Microsoft Learn

We hope that the information provided will help resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.

[stellahe102]

Hi @v-pnaroju-msft and @AntoineW ,thanks for all your previous replies

it's been 2 months since the CLS preview feature is released - Now I am able to see the column level security feature, but still the full configuration is not available yet, see below, the places that seems to be desgined for removing or adding columns are greyed out.

Question is, is this due to anything we need to enable from capacity or tenant admin side? OR this is due to the roll-out plan and this feature is still not ready yet to to our tenant? 

[stellahe102]

Just to confirm, is No.3 in below required,  in order to enable the CLS and RLS in lakehouse? As we have met all the other criteria except for No.3 (we couldn't enable this, pls see below screenshots)

---

Please follow the steps below, which may help to resolve the issue:

1. Open the lakehouse and select Manage OneLake security (preview) / Manage OneLake data access (preview) and ensure that it is enabled.
2. Confirm that the table is a Delta table. In Lakehouse Explorer, rightclick the table and select View files to check for the presence of _delta_log. If it is not a Delta table, reload or convert the data into a Delta table using Load to table or Spark write with format("delta").
3. If you plan to query via the SQL Analytics endpoint, switch OneLake access mode to User’s identity under Security.

---

The "Security" tab mentioned in the official doc (see below) for No.3 above, is not visible to us, is that a relative feature that we might need to wait for the roll out? 

View from Microsoft official doc:

This is our view:

[AntoineW · Accepted solution]

Yes @stellahe102,

It's a feature that isn't ready for now. It's a known problem currently affecting the OneLake Security control plane that Microsoft is working on.

Specifically, this issue involves metadata retrieval failures due to authentication errors in cross-rollout scenarios. These errors prevent the system from correctly fetching role metadata, which in turn causes latency or disables visibility of RLS/CLS configuration options in the Lakehouse UI.

> Impact: RLS/CLS roles may not load, and security options may be hidden or unresponsive.

So we have to wait a bit for this feature ! 

Best regards,

Antoine

[AntoineW]

@stellahe102,

Hello Same problem I've encounter : a bit frustrating ...

https://community.fabric.microsoft.com/t5/Fabric-platform/OneLake-Security-Lakehouse-can-t-find-the-...

[tayloramy]

@stellahe102, actually, this might already be enabled. 

Open your lakehouse and then at the top click on Manage OneLake data access (preview) to enable the feature on your lakehouse. 
This is irreversable, once enabled it cannot be disabled. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, please mark this as the solution.

[stellahe102]

the "Manage OneLake data access (preview)" has been enabled on the related lakehouse before I posted the original message, and we already use that feature for table level security, it is the column-level security feature that is not available, any idea why, and when it will be rolled out to our tenant? we are in US East2 region

[tayloramy]

Hi @stellahe102, 

Microsoft rolls out updates slowly by region, to ensure that a bug can't take down all regions at once, and to ensure they don't overload servers. 

This column level OneLake security came into public preview 4 days ago, so it could still be propagating down to all the tenants. I recommend waiting until maybe mid next week and trying again? 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, please mark this as the solution.

[tayloramy]

Hi @stellahe102, 

This was a private preview feature until a couple of days ago, so it appears it is not enabled on your tenant yet. I recommend giving it a few more days to see if the setting appears. Updates are rolled out gradually, and not enabled on all tenants all at once. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, please mark this as the solution.