One Lake Security - Can we hide a schema from users in Contributor role?

[wanthanaj]

Hi,

I am trying to hide a schema from Workspace Contributors. Is it possible?

Here are what I have done with the OneLake Security settings:
- created a custom role + assigned only a user group with Workspace admin rights + select only the restricted schema that I want workspace admin to be able to read/read write. 

- deleted a DefaultReader role.
 
I have also turned the Users's identity on in SQL analytics endpoint. Although, my aim is to completely restrict Workpace Contributors user group from seeing a particular schema.

Users in the workpace contributors role can still see and preview the tables under that schema in Lakehouse view. 

What did I miss?

Thanks in advance. 

[Anonymous]

Hi @wanthanaj ,

We haven’t received an update from you in some time. Could you please let us know if the issue has been resolved?
If you still require support, please let us know, we are happy to assist you.

Thank you.

[Anonymous]

Hi @wanthanaj ,

Thank you for reaching out to the Microsoft Fabric Community Forum. Thank you @suparnababu8 for your response.

Could you please let us know if the issue has been resolved? I wanted to check if you had the opportunity to review the information provided by @AntoineW and @tayloramy . If you still require support, please let us know, we are happy to assist you.

Thank you.

[tayloramy]

Hi @wanthanaj, 

Lets take a moment to understand Fabric workspace permissions. 

 Roles in workspaces in Microsoft Fabric - Microsoft Fabric | Microsoft Learn

Share Your Warehouse and Manage Permissions - Microsoft Fabric | Microsoft Learn

Contributor inheriently grants Read, ReadData, ReadAll,Write, and Monitor, so it will always grant access to all schemas. 

If you need to restrict the schemas, I recommend moving the warehouse/lakehouse to a different workspace where you can remove contributor access. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[suparnababu8]

Hi @wanthanaj 

I think it's not possible, bcz , you can't fully hide schemas from workspace contributors role in OneLake. Even if you configure custom roles and remove the DefaultReader role, Contributors retaiin visibilety of schemas and tables in the Lakehouse view because their control plane permiissions inherently allow them to view metadata.

Therfore, at present,OneLake security does not support hiding schemaas from workspace Contributors. You can deny access to the data itself, but they will still see the schema and table names in the Lakehouse view.

If you don;t want to see the metdata, then you can assign them as Viewer role.

Thank you!!

Did I answer your question? Mark my post as a solution!

Proud to be a Super User!

[wanthanaj]

Thank you.

OneLake security is the data plane security model for data in OneLake according to https://learn.microsoft.com/en-us/fabric/onelake/security/get-started-security#onelake-security-prev.... 

Could you guide me how to deny access to the data itself? Currently, they can still click to view in table view on the right-hand side in lakehouse view. It is ok for this group of contributors to see schema and table name.

[AntoineW · Accepted solution]

First, you have to remove users from the contributor role in the workspace.

Then, on your lakehouse, share your lakehouse to a groupe AD (the button is on the top right corner). 

Once is done, you can click on Manage Onelake Security, give it a role name, select the specific table and schema that they can have access : 

Finally, add members to this role (the groupe AD that you have shared).

So the fact you shared the lakehouse and you created this role, your can limit the access of your lakehouse schemas or tables.

Hope it can help you!

Best regards,

Antoine