Pastaba.
Prieigai prie šio puslapio reikalingas įgaliojimas. Galite bandyti prisijungti arba pakeisti katalogus.
Prieigai prie šio puslapio reikalingas įgaliojimas. Galite bandyti pakeisti katalogus.
This article describes how to use the authorized engine model to allow any engine or application to integrate with OneLake secured data.
OneLake security provides fine-grained access control on data in OneLake, and enforces it everywhere that the data is accessed. OneLake security is designed around a centralized policy definition with controlled, distributed enforcement. Security policies such as role-based permissions, row-level security (RLS), and column-level security (CLS) are authored and stored once in OneLake. Enforcement happens at query time inside the engine that's reading the data. However, not all engines understand how to enforce the access control policies that are defined in OneLake. As a result, OneLake blocks access to data with RLS or CLS policies set on it if the user isn't allowed to see all the data. To allow your own engine or application to enforce OneLake security, configure it as an authorized engine.
How distributed enforcement works
OneLake provides each authorized engine with a user's effective access, including the tables, rows, and columns that the user can access. The engine applies those permissions in its own query layer. Enforcing policies in the query engine lets the engine use its native query processing, caching, and optimization capabilities while OneLake remains the source of truth for the policy definitions. An engine that can't enforce a user's RLS or CLS permissions can't read the secured table on that user's behalf.
Note
For a deeper discussion of the design decisions behind centralized policy definition and distributed enforcement, see The future of data security is interoperability: A technical look at OneLake security.
Set up an authorized engine
Authorized engines are configured by a workspace Admin or Member by granting the engine identity the necessary privileges in Fabric. For each engine you want to authorize, use the following steps:
- Consult the documentation for your engine to locate the identity used by the engine to query data from external sources. Note that only Microsoft Entra identities are supported in Fabric.
- Add the engine identity to the Member role through workspace permissions. Authorized engine access is scoped to specific workspaces. This step gives the identity the necessary privileges to read OneLake security role metadata and read the physical data files from OneLake. You can revoke the identity's access at any time by removing it from the workspace role.