fabric-lakehouse-access-control

Name: fabric-lakehouse-access-control
Author: PatrickGallucci

16stars1forks

How to install fabric-lakehouse-access-control?

patrickgallucci/fabric-skills/fabric-lakehouse-access-control

$npx -y skills add PatrickGallucci/fabric-skills --skill fabric-lakehouse-access-control

Installs into the current project.

Summary

Troubleshoot Microsoft Fabric Lakehouse access control issues including OneLake security roles, SQL analytics endpoint permissions, workspace roles, data access roles, row-level security (RLS), column-level security (CLS), object-level security (OLS), dynamic data masking, shortc

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Fabric Lakehouse Access Control remediate
2
3	Diagnose and resolve access control issues across all security layers of Microsoft Fabric Lakehouse, including workspace roles, item permissions, OneLake security data access roles, SQL analytics endpoint granular permissions, and Direct Lake semantic model security integration.
4
5	## When to Use This Skill
6
7	- User cannot access lakehouse data or sees "permission denied" errors
8	- Queries return empty results or missing rows/columns unexpectedly
9	- OneLake security roles not applying or taking too long to propagate
10	- SQL analytics endpoint permissions not restricting access as expected
11	- Direct Lake semantic model returns errors after enabling OneLake security
12	- Shortcut data is inaccessible or returns 404 errors
13	- DefaultReader role conflicts with custom data access roles
14	- Deployment pipeline or git integration issues with data access roles
15	- Users see data they should not have access to (over-provisioned)
16	- Row-level or column-level security not filtering correctly
17
18	## Prerequisites
19
20	- Microsoft Fabric workspace with capacity or trial license
21	- Admin, Member, or Contributor workspace role for managing security
22	- Familiarity with T-SQL for SQL analytics endpoint security
23	- PowerShell 7+ for running diagnostic scripts
24
25	## Fabric Lakehouse Security Layers
26
27	Fabric Lakehouse enforces security through multiple overlapping layers. Understanding the evaluation order is critical for remediate.
28
29	Layer 1 - Workspace Roles control coarse access to all items in a workspace.
30
31	\| Role \| Workspace Access \| OneLake Read/Write \| Manage Security \|
32	\|------\|-----------------\|-------------------\|-----------------\|
33	\| Admin \| Full \| Yes \| Yes \|
34	\| Member \| Full \| Yes \| Yes \|
35	\| Contributor \| Full \| Yes \| No \|
36	\| Viewer \| See items only \| No (unless granted) \| No \|
37
38	Layer 2 - Item Permissions grant access to a single lakehouse without a workspace role. Key permissions: Read (see item), ReadAll (read all OneLake data), Reshare, Write.
39
40	Layer 3 - OneLake Security (Preview) provides granular role-based access at the table, folder, row, and column level. Enforced across all compute engines. Disabled by default; once enabled, cannot be turned off.
41
42	Layer 4 - SQL Analytics Endpoint Security uses T-SQL GRANT/DENY/REVOKE for object-level, row-level, and column-level security. Only applies to queries via the SQL analytics endpoint.
43
44	Layer 5 - Semantic Model Security applies RLS/OLS within Direct Lake or DirectQuery models only.
45
46	## Quick Diagnostic Workflow
47
48	Follow this sequence to isolate the root cause. See [workflow-diagnostics.md](./references/workflow-diagnostics.md) for full details.
49
50	### TODO
51	- [ ] Step 1: Identify the access path — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-1-identify-access-path)
52	- [ ] Step 2: Verify workspace role and item permissions — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-2-verify-workspace-and-item-permissions)
53	- [ ] Step 3: Check OneLake security role membership — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-3-check-onelake-security)
54	- [ ] Step 4: Audit SQL analytics endpoint permissions — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-4-audit-sql-endpoint-permissions)
55	- [ ] Step 5: Validate Direct Lake security integration — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-5-validate-direct-lake-integration)
56	- [ ] Step 6: Check shortcut and cross-region access — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-6-check-shortcuts)
57
58	## Common Issues and Resolutions
59
60	\| Symptom \| Likely Cause \| Resolution \|
61	\|---------\|-------------\|------------\|
62	\| User sees all data despite OneLake security roles \| DefaultReader role still active \| Delete or edit DefaultReader role to remove ReadAll grant \|
63	\| Empty results from queries \| RLS filtering all rows for user \| Check RLS predicates; verify user is member of correct role \|
64	\| "Can't find table" or "Column can't be found" in Direct Lake \| OLS/CLS hiding objects after OneLake security applied \| Add user to role with table/column access \|
65	\| Shortcut returns 404 \| Cross-region shortcut with OneLake security enabled \| OneLake security does not support cross-region shortcuts \|
66	\| Permission changes not taking effect \|

People who liked this also viewed

6 picks

Type

fabric-lakehouse-access-control

16stars1forks

View on GitHub

How to install fabric-lakehouse-access-control?

patrickgallucci/fabric-skills/fabric-lakehouse-access-control

$npx -y skills add PatrickGallucci/fabric-skills --skill fabric-lakehouse-access-control

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Fabric Lakehouse Access Control remediate
2
3	Diagnose and resolve access control issues across all security layers of Microsoft Fabric Lakehouse, including workspace roles, item permissions, OneLake security data access roles, SQL analytics endpoint granular permissions, and Direct Lake semantic model security integration.
4
5	## When to Use This Skill
6
7	- User cannot access lakehouse data or sees "permission denied" errors
8	- Queries return empty results or missing rows/columns unexpectedly
9	- OneLake security roles not applying or taking too long to propagate
10	- SQL analytics endpoint permissions not restricting access as expected
11	- Direct Lake semantic model returns errors after enabling OneLake security
12	- Shortcut data is inaccessible or returns 404 errors
13	- DefaultReader role conflicts with custom data access roles
14	- Deployment pipeline or git integration issues with data access roles
15	- Users see data they should not have access to (over-provisioned)
16	- Row-level or column-level security not filtering correctly
17
18	## Prerequisites
19
20	- Microsoft Fabric workspace with capacity or trial license
21	- Admin, Member, or Contributor workspace role for managing security
22	- Familiarity with T-SQL for SQL analytics endpoint security
23	- PowerShell 7+ for running diagnostic scripts
24
25	## Fabric Lakehouse Security Layers
26
27	Fabric Lakehouse enforces security through multiple overlapping layers. Understanding the evaluation order is critical for remediate.
28
29	Layer 1 - Workspace Roles control coarse access to all items in a workspace.
30
31	\| Role \| Workspace Access \| OneLake Read/Write \| Manage Security \|
32	\|------\|-----------------\|-------------------\|-----------------\|
33	\| Admin \| Full \| Yes \| Yes \|
34	\| Member \| Full \| Yes \| Yes \|
35	\| Contributor \| Full \| Yes \| No \|
36	\| Viewer \| See items only \| No (unless granted) \| No \|
37
38	Layer 2 - Item Permissions grant access to a single lakehouse without a workspace role. Key permissions: Read (see item), ReadAll (read all OneLake data), Reshare, Write.
39
40	Layer 3 - OneLake Security (Preview) provides granular role-based access at the table, folder, row, and column level. Enforced across all compute engines. Disabled by default; once enabled, cannot be turned off.
41
42	Layer 4 - SQL Analytics Endpoint Security uses T-SQL GRANT/DENY/REVOKE for object-level, row-level, and column-level security. Only applies to queries via the SQL analytics endpoint.
43
44	Layer 5 - Semantic Model Security applies RLS/OLS within Direct Lake or DirectQuery models only.
45
46	## Quick Diagnostic Workflow
47
48	Follow this sequence to isolate the root cause. See [workflow-diagnostics.md](./references/workflow-diagnostics.md) for full details.
49
50	### TODO
51	- [ ] Step 1: Identify the access path — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-1-identify-access-path)
52	- [ ] Step 2: Verify workspace role and item permissions — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-2-verify-workspace-and-item-permissions)
53	- [ ] Step 3: Check OneLake security role membership — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-3-check-onelake-security)
54	- [ ] Step 4: Audit SQL analytics endpoint permissions — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-4-audit-sql-endpoint-permissions)
55	- [ ] Step 5: Validate Direct Lake security integration — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-5-validate-direct-lake-integration)
56	- [ ] Step 6: Check shortcut and cross-region access — see [workflow-diagnostics.md](./references/workflow-diagnostics.md#step-6-check-shortcuts)
57
58	## Common Issues and Resolutions
59
60	\| Symptom \| Likely Cause \| Resolution \|
61	\|---------\|-------------\|------------\|
62	\| User sees all data despite OneLake security roles \| DefaultReader role still active \| Delete or edit DefaultReader role to remove ReadAll grant \|
63	\| Empty results from queries \| RLS filtering all rows for user \| Check RLS predicates; verify user is member of correct role \|
64	\| "Can't find table" or "Column can't be found" in Direct Lake \| OLS/CLS hiding objects after OneLake security applied \| Add user to role with table/column access \|
65	\| Shortcut returns 404 \| Cross-region shortcut with OneLake security enabled \| OneLake security does not support cross-region shortcuts \|
66	\| Permission changes not taking effect \|

People who liked this also viewed

6 picks

Type