Question

A Fabric Data Engineer manages a warehouse containing a SalesData table. Regional managers should only see rows for their own assigned region, and this restriction must be enforced consistently whenever the table is queried through the SQL analytics endpoint, regardless of the client tool used. The team wants to avoid creating separate filtered views for each manager. Which approach should the engineer implement?

Accepted Answer

Create a security policy with a filter predicate function that references USER_NAME() and maps it to the region column, applied to SalesData.

Answer

Apply dynamic data masking on the region column so each manager sees masked values for other regions.

Answer

Define a OneLake security role that restricts folder-level access to the SalesData Delta files by region.

Answer

Grant each regional manager the Viewer workspace role and create per-manager views that filter by region.