User not able to place files in lakehouse folder

[fabricpribeiro]

Dears,

We have created an entra-id group and provided to that group Viewer permissions at workspace level. At same time, using the onelake security,  we provided read and write permissions  to that same entra-id group (figure 1 example) on the folders where we wish the users to place files. After we addded the users into this group

The users can see the files but cannot upload them

Do we need to provide any additional permisisons? for example from figure 2?

Figure 2:

Figure 1:

Thanks,

Pedro

[v-nmadadi-msft]

Hi @fabricpribeiro 

May I check if this issue has been resolved? If not, Please feel free to contact us if you have any further questions.

Thank you

[sabledattatray · Accepted solution]

This is a very common point of confusion when setting up the new OneLake security roles!

Here is exactly what is happening under the hood:

The Fabric web portal UI currently does not support granular folder-level write operations defined solely by OneLake Data Access Roles. The web UI relies entirely on coarse-grained workspace-level or item-level write permissions.

Because your users are assigned the Viewer role at the workspace level, the web interface restricts their experience to read-only. That is why the upload button and options are grayed out in the middle of the screen for them.

To let them upload files, you have two options depending on how you want to manage their access:

Option 1: Bypass the Web Portal UI Even though the web UI grays out the upload button, your users actually DO have write access to that specific folder through the direct OneLake Storage API. They can upload files successfully using direct data tools like:

1. OneLake File Explorer installed locally on their Windows machine.
2. Azure Storage Explorer configured to connect directly to the OneLake path.
3. Spark notebooks or custom python or AzCopy scripts.

Option 2: Use Item Sharing if they must use the Web Portal UI If they absolutely must use the Web Portal to upload files, they need item-level write access. You should:

1. Remove them from the workspace Viewer role.
2. Share the Lakehouse item directly with the Entra ID group, checking the option to allow Read and Write on the whole Lakehouse. This will light up the upload button in the portal, but keep in mind they will be able to upload to any folder in the Lakehouse rather than just the specific one.

Hopefully, this clarifies the difference between portal UI permissions and direct OneLake role permissions. Let me know if this helps!

[v-nmadadi-msft]

Hi @fabricpribeiro ,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.

Thank you.

[tayloramy]

Hi @fabricpribeiro, 

If you're setting different behaviour between UI elements, I would recommend submitting a ticket to Microsoft so the product team can taake a look and see why the behaviour is different.  

[fabricpribeiro]

Also interesting to note, if the user does it from the left side pane (figure 3), he is able to do it. But if he uses the screen center (figure 4) to try to add the file, everything appears in gray . So the option he has, is to do it from the left pane side. Why can't he do it from the center of the screen?

Figure 3 :

Figure 4 :

[suparnababu8]

Hi @fabricpribeiro 

I would recommend your users to donwload OneLake Explorer and install in thier machines. The ask them to uplod the file. So it's easy to upload files. Web version have some restrictions, I'm not sure some case it's working and some cases it's not. 

Thank you!

Did I answer your question? Mark my post as a solution!

Proud to be a Super User!