
ONELAKE SECURITY / DESIGN STUDIO
Your use case.
The right security design.
Define who needs access, what they can see, and how they work. Build a practical plan backed by Microsoft documentation.
Dates describe our saved documentation snapshot. Individual Microsoft articles have their own update dates.
Your requirements
Start with an example, or describe your own.
Try a use case
Your security plan
A security plan built
around your requirements.
Choose an example on the left to see a complete plan, or enter your own requirements.
Compare audiences in one design
Build a plan for each audience, then add a snapshot here. Use the same source identifier for plans that share data. Plans stay in this tab’s memory until you close or reload it; download them to keep a copy.
Conflict checks use declared names and scopes. Different group names may still contain the same people; confirm actual memberships and inherited grants in Fabric.
What changed in Microsoft documentation?
17 source differences detected; 0 pending impact review.
Comparison: saved recommendation-review snapshot 10 Sep 2026 versus sources checked 20 Sep 2026.
Source changes versus advisor changes
Recommendation rules reviewed: 10 Sep 2026. A source check does not advance this date.
Advisor impact: See the source-specific impact reviews below. Reviewed changes do not automatically change permission rules.
Interface improvements are separate from Microsoft feature support.
This compares the saved Microsoft pages, not your Fabric tenant. A source check does not automatically approve a recommendation change. Unavailable pages are not assumed to represent removed features.
| Microsoft article | Previous article date | Current article date | Advisor impact |
|---|---|---|---|
| Set up and manage workspace retention | Not supplied | 16 Sep 2026 | Newly discovered supporting retention documentation. Retention is not proof of revoked identity access; review workspace identity lifecycle separately. Reviewed 2026-09-21. |
| Develop Direct Lake semantic models Changed sections: Choose the right storage mode | 23 Apr 2025 | 2 Sep 2026 | Source selection wording now refers to valid Delta tables and supported SQL sources. Guidance updated; existing identity and permission rules unchanged. Reviewed 2026-09-21. |
| Direct Lake overview Changed sections: Compare storage mode capabilities, Considerations and limitations | 15 Jun 2026 | 2 Sep 2026 | Direct Lake source compatibility clarified, including the distinction between engine support and model creation experience. It does not expand which items support OneLake roles. Guidance updated; existing permission decisions unchanged. Reviewed 2026-09-21. |
| Use Fabric Home to Find, Personalize, and Manage Content Changed sections: Multitasking across browser tabs, Personalize via settings | 27 Mar 2026 | 11 Sep 2026 | Fabric navigation, tab limits and regional language display updates; no security recommendation change. Reviewed 2026-09-21. |
| Use Iceberg tables with OneLake Changed sections: Availability and platform limitations, General limitations, Iceberg to Delta Lake, Understand the conversion log and error categories, Virtualize Delta Lake tables as Iceberg | 1 Jul 2025 | 30 Jul 2026 | Partial Iceberg V3 input support and conversion failure/dropped-feature behavior documented. Schema omissions are not column security. Troubleshooting guidance updated. Reviewed 2026-09-21. |
| OneLake, the unified data lake | 9 Mar 2026 | 9 Mar 2026 | Metadata-only update; article body unchanged. Reviewed 2026-09-21. |
| Add Fabric URLs to your allowlist Changed sections: Lakehouse | 13 Feb 2026 | 13 Feb 2026 | Added pbilhe.powerbi.com to documented inbound URLs. Consult the current allow-list when configuring firewalls; permission rules unchanged. Reviewed 2026-09-21. |
| Workspace identity Changed sections: App registrations, Considerations and limitations, Delete a workspace identity, Deleting the identity, Workspace identity - Microsoft Fabric | Microsoft Learn | 13 Aug 2026 | 16 Sep 2026 | Workspace identity deprovisioning waits for permanent workspace deletion; service principal and app registration remain during retention. Use Fabric controls for cleanup, not direct Azure portal deletion. Guidance updated; no automatic permission change. Reviewed 2026-09-21. |
| Connect to cloud data sources in the Power BI service - Power BI | 1 Oct 2025 | 1 Oct 2025 | Metadata-only update; article body unchanged. Reviewed 2026-09-21. |
| Apps in Power BI - Power BI Changed sections: What is a Power BI app? | 9 Jul 2026 | 9 Jul 2026 | Template app link and wording corrected; no security recommendation change. Reviewed 2026-09-21. |
| 'Power BI implementation planning: Content creator security planning - Power BI' Changed sections: Template apps | 30 Dec 2024 | 30 Dec 2024 | Template app link corrected; no security recommendation change. Reviewed 2026-09-21. |
| Catalog - Search - REST API (Core) Changed sections: Definitions, ErrorParameter, ErrorResponse, ErrorResponseDetails | 28 Dec 2022 | 28 Dec 2022 | REST error responses now document structured parameters with name, value and message. Role authorization and request contracts unchanged; API diagnostics guidance updated. Reviewed 2026-09-21. |
| OneLake Data Access Security - Create Or Update Data Access Roles - REST API (Core) Changed sections: Definitions, ErrorParameter, ErrorResponse, ErrorResponseDetails | 28 Dec 2022 | 28 Dec 2022 | REST error responses now document structured parameters with name, value and message. Role authorization and request contracts unchanged; API diagnostics guidance updated. Reviewed 2026-09-21. |
| OneLake Data Access Security - Create Or Update Single Data Access Role - REST API (Core) Changed sections: Definitions, ErrorParameter, ErrorResponse, ErrorResponseDetails | 28 Dec 2022 | 28 Dec 2022 | REST error responses now document structured parameters with name, value and message. Role authorization and request contracts unchanged; API diagnostics guidance updated. Reviewed 2026-09-21. |
| OneLake Data Access Security - Delete Data Access Role - REST API (Core) Changed sections: Definitions, ErrorParameter, ErrorResponse, ErrorResponseDetails | 28 Dec 2022 | 28 Dec 2022 | REST error responses now document structured parameters with name, value and message. Role authorization and request contracts unchanged; API diagnostics guidance updated. Reviewed 2026-09-21. |
| OneLake Data Access Security - Get Data Access Role - REST API (Core) Changed sections: Definitions, ErrorParameter, ErrorResponse, ErrorResponseDetails | 28 Dec 2022 | 28 Dec 2022 | REST error responses now document structured parameters with name, value and message. Role authorization and request contracts unchanged; API diagnostics guidance updated. Reviewed 2026-09-21. |
| OneLake Data Access Security - List Data Access Roles - REST API (Core) Changed sections: Definitions, ErrorParameter, ErrorResponse, ErrorResponseDetails | 28 Dec 2022 | 28 Dec 2022 | REST error responses now document structured parameters with name, value and message. Role authorization and request contracts unchanged; API diagnostics guidance updated. Reviewed 2026-09-21. |
View all 80 unchanged sources
| Microsoft article | Previous article date | Current article date | Advisor impact |
|---|---|---|---|
| Microsoft Fabric Admin Overview - Tools, Portal, and Settings | 21 Apr 2026 | 21 Apr 2026 | Matches the review snapshot; no source change to incorporate. |
| Manage Fabric identities | 21 Jun 2024 | 21 Jun 2024 | Matches the review snapshot; no source change to incorporate. |
| Developer admin settings | 8 Apr 2026 | 8 Apr 2026 | Matches the review snapshot; no source change to incorporate. |
| Encryption admin setting | 19 May 2025 | 19 May 2025 | Matches the review snapshot; no source change to incorporate. |
| Tenant settings index | 28 Aug 2026 | 28 Aug 2026 | Matches the review snapshot; no source change to incorporate. |
| Track user activities in Microsoft Fabric | 12 Feb 2026 | 12 Feb 2026 | Matches the review snapshot; no source change to incorporate. |
| Overview of Fabric Git integration | 21 Jul 2026 | 21 Jul 2026 | Matches the review snapshot; no source change to incorporate. |
| Lakehouse schemas | 24 Feb 2026 | 24 Feb 2026 | Matches the review snapshot; no source change to incorporate. |
| Spark support for OneLake security row-level and column-level security | 28 Apr 2026 | 28 Apr 2026 | Matches the review snapshot; no source change to incorporate. |
| Data Encryption in SQL Database in Fabric | 18 Mar 2026 | 18 Mar 2026 | Matches the review snapshot; no source change to incorporate. |
| Understand Microsoft Fabric licenses and capacity | 15 Jun 2026 | 15 Jun 2026 | Matches the review snapshot; no source change to incorporate. |
| Distribute Power BI Content to External Guest Users with Microsoft Entra B2B | 3 Nov 2025 | 3 Nov 2025 | Matches the review snapshot; no source change to incorporate. |
| How Direct Lake works | 22 Sep 2025 | 22 Sep 2025 | Matches the review snapshot; no source change to incorporate. |
| Integrate Direct Lake Security | 22 Sep 2025 | 22 Sep 2025 | Matches the review snapshot; no source change to incorporate. |
| Roles in workspaces in Microsoft Fabric | 24 Apr 2026 | 24 Apr 2026 | Matches the review snapshot; no source change to incorporate. |
| Share items in Microsoft Fabric | 6 Apr 2025 | 6 Apr 2025 | Matches the review snapshot; no source change to incorporate. |
| Enable external data sharing in a Fabric tenant | 19 Nov 2024 | 19 Nov 2024 | Matches the review snapshot; no source change to incorporate. |
| Manage external data shares | 19 Nov 2024 | 19 Nov 2024 | Matches the review snapshot; no source change to incorporate. |
| External Data Sharing in Microsoft Fabric | 10 Jun 2025 | 10 Jun 2025 | Matches the review snapshot; no source change to incorporate. |
| Information protection in Fabric | 13 Jul 2026 | 13 Jul 2026 | Matches the review snapshot; no source change to incorporate. |
| Discover and explore Fabric items using OneLake catalog's explore tab | 18 Feb 2026 | 18 Feb 2026 | Matches the review snapshot; no source change to incorporate. |
| Govern your Fabric data with the OneLake catalog | 12 Nov 2025 | 12 Nov 2025 | Matches the review snapshot; no source change to incorporate. |
| OneLake catalog overview | 20 Apr 2026 | 20 Apr 2026 | Matches the review snapshot; no source change to incorporate. |
| Secure your data | 5 Sep 2025 | 5 Sep 2025 | Matches the review snapshot; no source change to incorporate. |
| Create an Azure Data Lake Storage Gen2 shortcut | 14 Jan 2026 | 14 Jan 2026 | Matches the review snapshot; no source change to incorporate. |
| Create a Dataverse shortcut | 20 Nov 2025 | 20 Nov 2025 | Matches the review snapshot; no source change to incorporate. |
| Create a Google Cloud Storage(GCS) shortcut | 15 Mar 2024 | 15 Mar 2024 | Matches the review snapshot; no source change to incorporate. |
| Create shortcuts to on-premises data | 21 May 2024 | 21 May 2024 | Matches the review snapshot; no source change to incorporate. |
| Create an Amazon S3 compatible shortcut | 24 Jul 2025 | 24 Jul 2025 | Matches the review snapshot; no source change to incorporate. |
| Create an Amazon S3 shortcut | 25 Jul 2024 | 25 Jul 2024 | Matches the review snapshot; no source change to incorporate. |
| Create a OneLake Shared Access Signature (SAS) | 10 Apr 2025 | 10 Apr 2025 | Matches the review snapshot; no source change to incorporate. |
| Manage shortcut connections | 23 Apr 2025 | 23 Apr 2025 | Matches the review snapshot; no source change to incorporate. |
| How do I connect to OneLake? | 18 May 2026 | 18 May 2026 | Matches the review snapshot; no source change to incorporate. |
| Access OneLake with Python | 27 Sep 2023 | 27 Sep 2023 | Matches the review snapshot; no source change to incorporate. |
| OneLake parity and integration | 27 Sep 2023 | 27 Sep 2023 | Matches the review snapshot; no source change to incorporate. |
| OneLake consumption | 20 May 2026 | 20 May 2026 | Matches the review snapshot; no source change to incorporate. |
| OneLake diagnostics | 12 Jan 2026 | 12 Jan 2026 | Matches the review snapshot; no source change to incorporate. |
| Manage inbound access from OneLake with workspace private links | 20 Aug 2025 | 20 Aug 2025 | Matches the review snapshot; no source change to incorporate. |
| Manage inbound access to OneLake with Resource Instance Rules | 21 Jul 2026 | 21 Jul 2026 | Matches the review snapshot; no source change to incorporate. |
| Manage outbound access from OneLake with outbound access protection | 20 Jan 2026 | 20 Jan 2026 | Matches the review snapshot; no source change to incorporate. |
| What is a OneLake shared access signature (SAS) | 10 Apr 2025 | 10 Apr 2025 | Matches the review snapshot; no source change to incorporate. |
| Secure and manage OneLake shortcuts | 31 Jul 2026 | 31 Jul 2026 | Matches the review snapshot; no source change to incorporate. |
| Unify Data Sources With OneLake Shortcuts | 13 Jul 2026 | 13 Jul 2026 | Matches the review snapshot; no source change to incorporate. |
| Get authorized access for a principal | 11 Feb 2026 | 11 Feb 2026 | Matches the review snapshot; no source change to incorporate. |
| Security best practices | 5 Sep 2025 | 5 Sep 2025 | Matches the review snapshot; no source change to incorporate. |
| 'OneLake security roles: create and manage' | 28 Aug 2026 | 28 Aug 2026 | Matches the review snapshot; no source change to incorporate. |
| OneLake security roles, permissions, and scopes | 28 Aug 2026 | 28 Aug 2026 | Matches the review snapshot; no source change to incorporate. |
| Data security overview | 1 Sep 2026 | 1 Sep 2026 | Matches the review snapshot; no source change to incorporate. |
| Integrate a third-party engine with OneLake security (preview) | 3 Mar 2026 | 3 Mar 2026 | Matches the review snapshot; no source change to incorporate. |
| OneLake security integrations overview | 3 Mar 2026 | 3 Mar 2026 | Matches the review snapshot; no source change to incorporate. |
| OneLake security integrations reference | 11 Feb 2026 | 11 Feb 2026 | Matches the review snapshot; no source change to incorporate. |
| Read data secured with OneLake security | 28 Aug 2026 | 28 Aug 2026 | Matches the review snapshot; no source change to incorporate. |
| OneLake row-level security (RLS) syntax | 27 Jul 2026 | 27 Jul 2026 | Matches the review snapshot; no source change to incorporate. |
| OneLake Security for SQL analytics endpoints | 22 Jul 2026 | 22 Jul 2026 | Matches the review snapshot; no source change to incorporate. |
| OneLake table, column, and row-level security | 19 Aug 2026 | 19 Aug 2026 | Matches the review snapshot; no source change to incorporate. |
| Troubleshoot OneLake security for SQL analytics endpoints | 29 Apr 2026 | 29 Apr 2026 | Matches the review snapshot; no source change to incorporate. |
| Create an Azure Blob Storage shortcut | 16 Oct 2025 | 16 Oct 2025 | Matches the review snapshot; no source change to incorporate. |
| Create a cross-tenant OneLake shortcut | 31 Jul 2026 | 31 Jul 2026 | Matches the review snapshot; no source change to incorporate. |
| Create a OneDrive or SharePoint shortcut | 27 Aug 2026 | 27 Aug 2026 | Matches the review snapshot; no source change to incorporate. |
| Create a same-tenant OneLake shortcut | 31 Jul 2026 | 31 Jul 2026 | Matches the review snapshot; no source change to incorporate. |
| Permission model | 22 May 2025 | 22 May 2025 | Matches the review snapshot; no source change to incorporate. |
| Add Power BI URLs to allowlist | 13 Feb 2026 | 13 Feb 2026 | Matches the review snapshot; no source change to incorporate. |
| Protect inbound traffic | 13 Aug 2025 | 13 Aug 2025 | Matches the review snapshot; no source change to incorporate. |
| About inbound access protection in Fabric | 27 Jan 2026 | 27 Jan 2026 | Matches the review snapshot; no source change to incorporate. |
| Overview of managed private endpoints for Microsoft Fabric | 12 May 2025 | 12 May 2025 | Matches the review snapshot; no source change to incorporate. |
| Set up and use a tenant-level private link | 13 Aug 2025 | 13 Aug 2025 | Matches the review snapshot; no source change to incorporate. |
| Trusted workspace access in Microsoft Fabric | 13 Aug 2026 | 13 Aug 2026 | Matches the review snapshot; no source change to incorporate. |
| About workspace IP firewall rules | 9 Mar 2026 | 9 Mar 2026 | Matches the review snapshot; no source change to incorporate. |
| Overview of workspace-level private links | 26 May 2026 | 26 May 2026 | Matches the review snapshot; no source change to incorporate. |
| Customer-managed keys for Fabric workspaces | 15 Oct 2025 | 15 Oct 2025 | Matches the review snapshot; no source change to incorporate. |
| Authenticate with Microsoft Fabric workspace identity | 13 Aug 2026 | 13 Aug 2026 | Matches the review snapshot; no source change to incorporate. |
| Create an allow list using data connection rules | 1 Dec 2025 | 1 Dec 2025 | Matches the review snapshot; no source change to incorporate. |
| Workspace outbound access protection overview | 9 Feb 2026 | 9 Feb 2026 | Matches the review snapshot; no source change to incorporate. |
| Roles in workspaces in Power BI - Power BI | 1 Dec 2025 | 1 Dec 2025 | Matches the review snapshot; no source change to incorporate. |
| Manage Semantic Model Access Permissions in Power BI - Power BI | 28 Aug 2026 | 28 Aug 2026 | Matches the review snapshot; no source change to incorporate. |
| Semantic model permissions - Power BI | 1 Oct 2025 | 1 Oct 2025 | Matches the review snapshot; no source change to incorporate. |
| 'Power BI implementation planning: Report consumer security planning - Power BI' | 30 Dec 2024 | 30 Dec 2024 | Matches the review snapshot; no source change to incorporate. |
| Identity support for logging into the Microsoft Fabric - Microsoft Fabric REST APIs | 4 Aug 2024 | 4 Aug 2024 | Matches the review snapshot; no source change to incorporate. |
| OneLake Data Access Security - REST API (Core) | 28 Dec 2022 | 28 Dec 2022 | Matches the review snapshot; no source change to incorporate. |
| OneLake Shortcuts - REST API (Core) | 28 Dec 2022 | 28 Dec 2022 | Matches the review snapshot; no source change to incorporate. |