Dynamic Data Masking in Fabric Direct Lake

Hi elleesse85 

Dynamic Data Masking (DDM) on a Fabric Lakehouse SQL endpoint works at the T-SQL query layer, but Power BI does not yet honor the UNMASK permission when connecting through its DirectQuery or Import models—it simply receives the masked data from the SQL endpoint as if the user does not have the unmask right. This happens because when Power BI connects, it usually uses a service principal or dataset identity, not the end user’s credentials, so the GRANT UNMASK privilege on your personal user does not apply; the query is executed under the dataset’s identity, which doesn’t have unmask privileges. To deal with this, you need to either grant UNMASK to the identity that Power BI uses (service principal / workspace identity), or implement row-level security or custom masking logic directly in the dataset (e.g., with conditional DAX measures) rather than relying on DDM at query time. Currently, Fabric SQL Endpoints + Power BI do not support per-user unmasking with DDM unless end-user passthrough is enabled and the connecting identity has UNMASK.