Question

Your team publishes a Direct Lake semantic model over a lakehouse. Security requirements state that row-level filtering must be enforced consistently whether users query through the semantic model, the SQL analytics endpoint, or Spark. The analytics engineer wants to define the security once at the data layer rather than duplicating logic in DAX RLS roles. Which approach on the newer Direct Lake on OneLake mode best meets this goal?

Accepted Answer

Define OneLake security roles (row/column-level security) at the lakehouse Delta table level so the rules apply across the semantic model, SQL endpoint, and Spark access.

Answer

Create DAX row-level security roles in the semantic model and rely on the SQL analytics endpoint to inherit them automatically.

Answer

Configure object-level security (OLS) in the semantic model to hide restricted rows from all query paths.

Answer

Apply a sensitivity label to the lakehouse and enable dynamic data masking on the SQL endpoint columns.