Question

A Fabric lakehouse contains a Delta table with sensitive HR salary data. You have defined a OneLake security role named 'AnalystRole' that grants read access only to non-sensitive columns of the table. A user, Maya, needs to query the table through the SQL analytics endpoint and via Spark notebooks, but she must never see the salary column. Maya is currently assigned the Viewer role on the workspace. What is the correct approach to ensure Maya's access is restricted to the non-sensitive columns across both access paths?

Accepted Answer

Remove Maya from the workspace Viewer role and add her only as a member of the OneLake security role 'AnalystRole', which enforces the column restriction consistently across OneLake access paths.

Answer

Keep Maya in the Viewer role and rely on it, because the Viewer role automatically inherits OneLake security role restrictions.

Answer

Add Maya to the workspace Admin role so the OneLake security role can be applied to her queries.

Answer

Create a T-SQL column-level GRANT on the SQL analytics endpoint only, since OneLake security roles do not apply to Spark notebooks.