Question

A Fabric warehouse contains a table named dbo.Employees that includes a Salary column. The HR analytics team must be able to query all other columns in the table, but they must be denied access to the Salary column specifically. You want to enforce this at the object level using T-SQL without creating a separate view or masking the data. What should you do?

Accepted Answer

Use DENY SELECT ON dbo.Employees(Salary) TO the HR analytics role while granting SELECT on the table.

Answer

Apply dynamic data masking to the Salary column for the HR analytics team.

Answer

Create a row-level security predicate function that filters out the Salary column.

Answer

Assign the HR analytics team the Viewer role on the workspace to hide the Salary column.