OneLake Security CLS/RLS issue

[AditiPattnaik]

Hey there, 

I was experimenting with OneLake Security but got stuck while applying CLS/RLS.
So after giving permission to lakehouse, the issues am facing are
1) The viewer can see the table and data but the moment am applying CLS/RLS on that particular table, the viewer is not able to see the data and it says unable to refresh the table in the Lakehouse UI. 

Here i have applied CLS on agent data and RLS on sales_consolidated that the viewer is not able to see or load.

2) In the SQL analytics endpoint, when i did using delegated identity, viewer could perform select query and see the data without CLS/RLS enforcement though but with enabled user identity and with CLS/RLS applied,
                         1) Viewer is not able to query the data

                         2) Can see all the tables even ones without permission but not the data. 

I tried but seems like not working for me. May be I missed some steps. Can anyone help me in this?

[AditiPattnaik]

Hi,
Thank you for the response.
However, i have tried the same steps but still facing the same issue. 

[v-kpoloju-msft · Accepted solution]

Hi @AditiPattnaik, 
Thank you for the detailed explanation and screenshots.

Based on your scenario, the behaviour you are seeing is expected when One Lake security (CLS/RLS) is enabled and the SQL analytics endpoint is configured to use User identity. Workspace roles such as Viewer only allow users to see metadata (like table names), but actual data access is controlled separately through One Lake security permissions.

Once CLS/RLS is applied, users must be explicitly granted Read permission at the schema, table, or folder level using Manage One Lake security. Without this Read permission, the Lakehouse UI cannot preview the data, and the SQL analytics endpoint will return errors such as SELECT permission was denied.

To resolve this, please open the Lakehouse, select the affected schema or table, and use Manage One Lake security to grant the user Read permission. After allowing a short time for permission propagation, the user should be able to preview and query the data successfully, while CLS/RLS continues to enforce the intended restrictions.

Refer these links:
1. https://learn.microsoft.com/en-us/fabric/onelake/security/data-access-control-model 
2. https://learn.microsoft.com/en-us/fabric/onelake/security/get-started-security 
3. https://learn.microsoft.com/en-us/fabric/data-engineering/workspace-roles-lakehouse 
4. https://learn.microsoft.com/en-gb/fabric/data-engineering/lakehouse-sql-analytics-endpoint 

Hope this clarifies. Let us know if you have any doubts regarding this. We will be happy to help.

Thank you for using the Microsoft Fabric Community Forum.

[v-kpoloju-msft]

Hi @AditiPattnaik, 

Just checking in to see if the issue has been resolved on your end. If the earlier suggestions helped, that’s great to hear! And if you’re still facing challenges, feel free to share more details happy to assist further.

Thank you.

[v-kpoloju-msft]

Hi @AditiPattnaik, 

Just wanted to follow up. If the shared guidance worked for you, that’s wonderful hopefully it also helps others looking for similar answers. If there’s anything else you'd like to explore or clarify, don’t hesitate to reach out.

Thank you.

[suparnababu8]

Hello @AditiPattnaik 

I written blog about OneLake RLS Fine-grained ReadWrite access to data with OneLake... - Microsoft Fabric Community   

Please take llok at above blog, it helps you.

Thank you!!

Did I answer your question? Mark my post as a solution!

Proud to be a Super User!