Question

A data engineering team stores curated data in a Fabric lakehouse. The Files section contains subfolders named 'finance', 'hr', and 'marketing'. A group of analysts must be able to read only the contents of the 'marketing' folder through OneLake, without gaining access to the other folders or to any tables in the lakehouse. The team wants to enforce this using the least-privilege approach native to OneLake. What should you configure?

Accepted Answer

Create a OneLake security role that grants read access scoped to the 'marketing' folder and assign the analyst group to that role

Answer

Assign the analyst group the Viewer role on the workspace so they can browse only folders they need

Answer

Apply a sensitivity label to the 'marketing' folder and grant the analyst group label permissions

Answer

Grant the analyst group ReadAll permission on the lakehouse SQL analytics endpoint