Forum Discussion
Dynamic Data Masking in Fabric Direct Lake
Hello everyone,
I'm trying to implement Dynamic Data Masking to a table in a Lakehouse (SQL Endpoint), so that only users with the GRANT UNMASK permission can view data, but while it works on the SQL Endpoint the connected PBI report looks like it doesn't recognize the permission and shows masked data for every single user with any role.
How can I deal with that?
Thank you in advance!
Luca
Hi elleesse85
Dynamic Data Masking (DDM) on a Fabric Lakehouse SQL endpoint works at the T-SQL query layer, but Power BI does not yet honor the UNMASK permission when connecting through its DirectQuery or Import models—it simply receives the masked data from the SQL endpoint as if the user does not have the unmask right. This happens because when Power BI connects, it usually uses a service principal or dataset identity, not the end user’s credentials, so the GRANT UNMASK privilege on your personal user does not apply; the query is executed under the dataset’s identity, which doesn’t have unmask privileges. To deal with this, you need to either grant UNMASK to the identity that Power BI uses (service principal / workspace identity), or implement row-level security or custom masking logic directly in the dataset (e.g., with conditional DAX measures) rather than relying on DDM at query time. Currently, Fabric SQL Endpoints + Power BI do not support per-user unmasking with DDM unless end-user passthrough is enabled and the connecting identity has UNMASK.
12 Replies
Hi. I'm sorry but that's not possible yet. The feature of dynamic masking is a SQL Endpoint feature, not a warehouse one. The direct lake docs says: "Using columns that apply dynamic data masking (DDM) in Direct Lake semantic models is not supported.".
https://learn.microsoft.com/en-us/fabric/fundamentals/direct-lake-develop
For now it's not possible, you need to get data with SQL Endpoint or query the sql endpoint.
I hope that helps,
I really don't understand, I turned the access from Workspace Viewer (first screenshot) to Admin and that's what the output looks like, so something is working...
Alright! Yes, the user shouldn't have admin, contributor or member priviledges. The users should be shared the sql endpoint or viewer of the workspace. However, it's a surprised that worked with direct lake due to the fact that the docs are specifying that line in a red note.
I'm glad that worked.
Regards
The thing is much more complex, it looks like data are masked / unmasked for everyone
Hi elleesse85,
we are reaching out to check whether you question got answered? please let us know if you still need help here.
ibarrau, Thanks for your prompt response
Thanks,
Prashanth Are
MS Fabric community support
If our super user response resolved your issue, please mark it as "Accept as solution".
Hi,
if possible I would like more insights on this subject since even the super user was surprised by the outcome I posted in the screenshots.
Thanks!
Luca
This is the official doc for the Dynamic Masking feature in Fabric.
https://learn.microsoft.com/en-us/fabric/data-warehouse/dynamic-data-maskingI hope that helps
Hi elleesse85,
As we haven't heard back from you we would like to check if your query got resolved or any progress here. let us know you still need assistance here.
thanks,
Prashanth
Hi elleesse85
Dynamic Data Masking (DDM) on a Fabric Lakehouse SQL endpoint works at the T-SQL query layer, but Power BI does not yet honor the UNMASK permission when connecting through its DirectQuery or Import models—it simply receives the masked data from the SQL endpoint as if the user does not have the unmask right. This happens because when Power BI connects, it usually uses a service principal or dataset identity, not the end user’s credentials, so the GRANT UNMASK privilege on your personal user does not apply; the query is executed under the dataset’s identity, which doesn’t have unmask privileges. To deal with this, you need to either grant UNMASK to the identity that Power BI uses (service principal / workspace identity), or implement row-level security or custom masking logic directly in the dataset (e.g., with conditional DAX measures) rather than relying on DDM at query time. Currently, Fabric SQL Endpoints + Power BI do not support per-user unmasking with DDM unless end-user passthrough is enabled and the connecting identity has UNMASK.
Hi, thanks for your answer 🙂 is the end-user passthrough solution feasible or not? Have you ever tried that? Moreover, DDM isn't inherited only by Power BI or even by other downstream applications?
Thanks in advance!
L.
Hi elleesse85,
We would like to confirm if you've successfully resolved this issue or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are more than happy to continue to help you.
Thank you for your patience and look forward to hearing from you.
Best Regards,Prashanth Are
Hi, resolved but not 100% satisfied with the answer 😄 is the DDM integration on Power BI on the roadmap or not?
