Granular Data Protection in Microsoft Fabric: Implementing OneLake Security with OLS, CLS, and RLS

As enterprises continue to adopt Microsoft Fabric for unified data management and analytics, ensuring secure and controlled data access becomes paramount. In highly regulated industries or data-sensitive environments, simply securing the overall dataset isn’t enough. You need granular data protection—controlling access down to the table, column, and even row level. This is where Object-Level Security (OLS), Column-Level Security (CLS), and Row-Level Security (RLS) in OneLake come into play.

In this blog post, we’ll explore how to implement these security features effectively in OneLake, enabling fine-grained access control while maintaining performance and scalability.

What is OneLake?

OneLake is the unified data lake in Microsoft Fabric, offering a single logical data lake for your entire organization. It allows various workloads—like Data Engineering, Data Science, Real-Time Analytics, and BI—to interact with shared data seamlessly while keeping data security and governance in check.

With OneLake, securing data is not just about locking folders. It’s about enabling role-based, need-to-know access to only what’s required. That’s where OLS, CLS, and RLS become critical.

Note: OneLake security is currently in a limited preview. To request to join the preview and access these features, fill out the form at https://aka.ms/onelakesecuritypreview

1. Object-Level Security (OLS): Secure Tables and Folders

Use Case: Restrict access to specific tables or folders within a Fabric Lakehouse.

What it does: OLS lets you hide entire tables or folders from unauthorized users. Even metadata like table names and schemas won’t be visible to those without permission.

How to Implement OLS

1. Navigate to your Lakehouse or Warehouse in Microsoft Fabric.
2. Use the Access Control panel to assign permissions.
3. Remove Read or Metadata access for users or groups on specific tables or folders.
4. Validate using another user profile to ensure hidden resources don’t appear.

Best Practice: Apply OLS to protect sensitive datasets (like financial or HR data) from visibility across departments.

2. Column-Level Security (CLS): Restrict Sensitive Fields

Use Case: Hide or restrict access to specific columns like SSNs, salary data, or PII, while letting users see other non-sensitive fields in the same table.

What it does: CLS ensures that even if a user can access a table, specific columns will be invisible or inaccessible to them based on defined security roles.

How to Implement CLS

1. Create a security role in your Lakehouse.
2. Define column access policies using DENY COLUMN permissions in T-SQL or through UI.
3. Assign users or groups to roles accordingly.

3. Row-Level Security (RLS): Filter Data by User Role

Use Case: Limit access to specific rows in a table, based on user roles or attributes.

What it does: RLS filters data at runtime, showing only the rows a user is permitted to see—ideal for department-level access, regional segregation, or personalized data views.

How to Implement RLS

1. Create a security predicate (filter logic) on the table.
2. Define roles with specific conditions using T-SQL:
3. Assign users to roles and test visibility accordingly.

Bringing It All Together: OLS + CLS + RLS

Implementing all three layers provides defense-in-depth:

Combination Example:

A sales analyst in the East region only sees sales records for East customers (RLS), can’t view customer credit scores (CLS), and doesn’t even know the existence of the HR folder (OLS).

Final Tips for Granular Security Implementation

• Plan roles upfront: Design your security model around business roles and use cases.
• Use Entra ID groups: Easier management and automation of access controls.
• Audit regularly: Review permissions periodically to ensure compliance.
• Test with different user personas before deployment.

Conclusion

Granular data protection in Microsoft Fabric is not just about security—it’s about enabling responsible data access that drives insights without compromising compliance or privacy. By effectively implementing OLS, CLS, and RLS in OneLake, organizations can ensure the right people access the right data—and only the right data.

About CloudThat