🔐 OneLake security roles can have members nobody explicitly added.
That's not a bug. That's Virtual Members. 👥
In Microsoft Fabric, workspace roles and item permissions don't just control the workspace.
They automatically map into OneLake security roles inside a Lakehouse.
🏢 Assign someone as a Workspace Viewer.
🏠 They land in the matching OneLake role — automatically, without a separate step.
Most teams don't know this exists and end up managing two layers of security separately.
You don't have to. ✅
In this week's Fabric Monday, I walk through how Virtual Members work,
how the mapping is structured, and what it means for your Lakehouse security model. 🎥
watch?v=GPI50TzJNCs
