Question

A Fabric Analytics Engineer manages a lakehouse that stores raw CSV and Parquet files in the Files section of OneLake. A team of external contractors needs read access only to a specific subfolder containing anonymized sample data, but they must not be able to see or query any other folders, tables, or the SQL analytics endpoint. The engineer wants to enforce this using native Fabric capabilities without duplicating data. Which approach should the engineer use?

Accepted Answer

Create a OneLake data access role on the lakehouse that grants read permission scoped to the specific subfolder, then assign the contractors to that role.

Answer

Add the contractors to the workspace with the Viewer role so they can browse only the intended subfolder.

Answer

Apply a dynamic row-level security (RLS) filter on the lakehouse tables using USERNAME() to restrict the contractors to the sample data.

Answer

Share the lakehouse item with the contractors and grant the ReadAll permission to expose the sample folder.