Forum Discussion
Lakehouse SQL endpoint access
Hi Manu002 ,
This behavior is expected in Microsoft Fabric. Currently, SQL Endpoints are shared at the workspace level, not per individual Lakehouse. That means if a user has access to the SQL Endpoint, they can query all Lakehouses within that workspace.
To manage access more granularly:
- Consider separating Lakehouses into different workspaces if isolation is required.
- Use row-level security (RLS) within the Lakehouse to restrict data access.
- Only admins can manage certain permissions like ReadData, so if you're just a member, you may not see or assign all access levels.
Hopefully, Microsoft will introduce more granular SQL Endpoint controls in future updates.
Hi Manu002 ,
Thank you for reaching out to us on the Microsoft Fabric Community Forum.
Thank you burakkaragoz for providing possible solution. SQL Endpoints are scoped at the workspace level, not at the individual Lakehouse level. So if a user has access to the workspace SQL Endpoint, they will be able to query all Lakehouses within that workspace.
To manage access more securely, create separate workspaces and Use Row-Level Security (RLS) to control data visibility within a shared Lakehouse.
If this post was helpful, please give us Kudos and consider marking Accept as solution to assist other members in finding it more easily
Thank you both for the detailed clarification. The distinction that SQL Endpoints are scoped at the workspace level is crucial, especially for organizations aiming to implement fine-grained access control across multiple Lakehouses.
While separating Lakehouses into different workspaces is a viable workaround, it introduces operational overhead—especially in environments with many data domains or tenants. In such cases, managing workspace sprawl, permissions, and deployment pipelines can become complex.
Implementing Row-Level Security (RLS) within a shared Lakehouse is a good mitigation strategy, but it doesn’t fully address scenarios where metadata isolation or query surface minimization is required (e.g., in multi-tenant architectures).
It would be highly beneficial if Microsoft Fabric could support:
- Lakehouse-scoped SQL Endpoints, allowing tighter control over query access.
- Endpoint-level permission granularity, such as restricting visibility to specific tables or views.
- Auditing and monitoring at the SQL Endpoint level to track cross-Lakehouse access.
Looking forward to future updates that might bring more flexibility in this area. Thanks again for the insights!