Question

You manage a Fabric lakehouse containing a Delta table named Employees that holds payroll data. The finance team must query all columns, but a broader analyst group must be able to see every row while being blocked from viewing the Salary and BonusAmount columns. You want to enforce this directly in OneLake so the restriction applies consistently whether the data is accessed through the SQL analytics endpoint, Spark notebooks, or the lakehouse itself. What should you configure?

Accepted Answer

Create a OneLake security role that grants the analyst group read access to the Employees table but excludes the Salary and BonusAmount columns via column-level security.

Answer

Apply dynamic data masking to the Salary and BonusAmount columns on the SQL analytics endpoint for the analyst group.

Answer

Create a T-SQL view that omits the sensitive columns and grant the analyst group SELECT permission only on that view.

Answer

Assign the analyst group the Viewer workspace role and remove their access to the Employees table folder.