Azure AD Security Group In Lakehouse SQL analytics endpoint

[verianalizi]

Hello,

Can I access AD Security group in Lakehouse SQL analytics endpoint? I tried IS_MEMBER ('AnyGroupName')  function. But it didn't work. It returned "NULL". Do you have any idea? My aim is to create RLS security in SQL with Security Groups.

Below link says for IS_MEMBER function:  "... current user is a member of a database role or a Windows domain group."

https://learn.microsoft.com/en-us/sql/t-sql/functions/is-member-transact-sql?view=sql-server-ver16

Thanks in advance.

[v-gchenna-msft]

Hi @verianalizi ,

Thanks for using Fabric Community.

RLS security in SQL Endpoint - Fabric with Security Groups can be implemented.
For detail process please check this link for reference.

Hope this is helpful. Please let me know incase of further queries.

[verianalizi]

Hello thank you for your response but I can't access the link. "about:blank#blocked"

[v-gchenna-msft]

Hi @verianalizi ,

Please refer this link - Row-level security in Fabric data warehousing - Microsoft Fabric | Microsoft Learn

[v-gchenna-msft]

Hi @verianalizi ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet .
In case if you have any resolution please do share that same with the community as it can be helpful to others .
Otherwise, will respond back with the more details and we will try to help .

[v-gchenna-msft]

Hi @verianalizi ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet .
In case if you have any resolution please do share that same with the community as it can be helpful to others .
Otherwise, will respond back with the more details and we will try to help .

[fabricator1]

Hi @v-gchenna-msft,

The approach shown in the link, is using USER_NAME() for single user only.

-- Creating a function for the SalesRep evaluation
CREATE FUNCTION Security.tvf_securitypredicate(@SalesRep AS nvarchar(50))
RETURNS TABLE
WITH SCHEMABINDING
AS
RETURN SELECT 1 AS tvf_securitypredicate_result
WHERE @SalesRep = USER_NAME() OR USER_NAME() = 'manager@contoso.com';
GO

How can we do it for Entra ID security groups?

I have tried to do that, but I wasn't succesful. Can you provide some guidance. Please see my post: SQL Analytics Endpoint - RLS for Security Groups - Microsoft Fabric Community