Question

You manage a Fabric warehouse that contains an Employees table with a Salary column. The HR analytics team must query all columns, but a group of operational reporting users must be able to query the Employees table for everything except the Salary column. You want to enforce this at the warehouse layer using T-SQL so the restriction applies regardless of which client tool connects. What should you implement?

Accepted Answer

Use column-level security by granting the operational group SELECT on all columns except Salary with a GRANT/DENY statement.

Answer

Apply a sensitivity label to the Salary column and rely on label-based protection to block access.

Answer

Create a row-level security policy with a predicate function that filters the Salary values.

Answer

Set the Salary column data type to a masked format using dynamic data masking for the operational group.