OneLakeDataAccessSecurity

Properties

Property	Type	Attributes	Description
decisionRules	DataAccessRoleDecisionRule[]	Required	The permissions that make up the data access role
itemId	string	Required, Identifier	The ID of the Fabric item the data access role applies to
members	DataAccessRoleMembers	Required	The members of the role
roleName	string	Required, Identifier	The name of the data access role
workspaceId	string	Required, Identifier	The containing Fabric workspace ID
kind	'Policy'		The kind of the data access role

DataAccessRoleDecisionRule

Property	Type	Attributes	Description
effect	'Permit'	Required	The effect that this rule has on access to the data resource
permission	DataAccessRolePermissionScope[]	Required	The permissions defined by attribute name and values
constraints	DataAccessRoleConstraints		Row or column level constraints applied to tables as part of this rule. If omitted, no constraints apply

DataAccessRoleMembers

Property	Type	Attributes	Description
fabricItemMembers	DataAccessRoleFabricItemMember[]		Fabric-scoped members with path-based access
microsoftEntraMembers	DataAccessRoleMicrosoftEntraMember[]		Microsoft Entra ID members

DataAccessRolePermissionScope

Property	Type	Attributes	Description
attributeName	'Path' | 'Action'	Required	The name of the attribute being evaluated for access permissions
attributeValueIncludedIn	string[]	Required	The allowed values for this attribute

DataAccessRoleConstraints

Property	Type	Attributes	Description
columns	DataAccessRoleColumnConstraint[]		Column-level constraints applied to one or more tables in the data access role
rows	DataAccessRoleRowConstraint[]		Row-level constraints applied to one or more tables in the data access role

DataAccessRoleFabricItemMember

Property	Type	Attributes	Description
itemAccess	('Read' | 'Write' | 'Reshare' | 'Explore' | 'Execute' | 'ReadAll')[]	Required	The permissions granted for the item
sourcePath	string	Required	The path to the Fabric item having the specified item access, as two GUIDs separated by a slash

DataAccessRoleMicrosoftEntraMember

Property	Type	Attributes	Description
objectId	string	Required	The Microsoft Entra object ID
objectType	'Group' | 'User' | 'ServicePrincipal' | 'ManagedIdentity'	Required	The type of Microsoft Entra object
tenantId	string	Required	The Microsoft Entra tenant ID

DataAccessRoleColumnConstraint

Property	Type	Attributes	Description
columnAction	'Read'[]	Required	The actions applied to the column names
columnEffect	'Permit'	Required	The effect given to the specified column names
columnNames	string[]	Required	The case-sensitive column names the constraint applies to. Use '*' to indicate all columns
tablePath	string	Required	A relative file path specifying which table the column constraint applies to, in the form /Tables/{optionalSchema}/{tableName}

DataAccessRoleRowConstraint

Property	Type	Attributes	Description
tablePath	string	Required	A relative file path specifying which table the row constraint applies to, in the form /Tables/{optionalSchema}/{tableName}
value	string	Required	A T-SQL expression used to evaluate which rows the role members can see