Question

Your team manages a Fabric lakehouse whose SQL analytics endpoint exposes several tables. A group of business analysts needs to run T-SQL queries against only the 'SalesSummary' view in the SQL analytics endpoint, but they must not be able to see or query any other table in the endpoint. The analysts should not be added to any workspace role. What is the most appropriate way to grant this access?

Accepted Answer

Share the lakehouse with the analysts, then use T-SQL GRANT SELECT on the 'SalesSummary' view (and no other object) at the SQL analytics endpoint.

Answer

Grant the analysts the Viewer workspace role so they inherit read access to the lakehouse, then apply object-level security in the semantic model.

Answer

Apply a OneLake data access role that filters the underlying Delta files so only 'SalesSummary' data is visible.

Answer

Create a sensitivity label named 'SalesOnly' and apply it to the 'SalesSummary' view so only labeled objects are queryable.