Power Platform Community Forum Thread Details

Hi Team,

I’m looking for help regarding Row‑Level Security (RLS) with Fabric Data Agent.

Scenario

We have created a Fabric Data Agent
The Data Agent is directly connected to Lakehouse tables
The Data Agent is NOT built on a semantic mode

Requirement

We need row-level security so that users only see the data they’re authorized to see (similar to how RLS works in Power BI)
Example: When a Sales Head logs in through a custom portal and queries the Fabric Data Agent, they should be able to see only the rows assigned to them as the Sales Head. We also have a master table that stores the Sales Head email IDs and their assignments.

Questions

Is RLS on Lakehouse tables expected to be enforced when accessed via Fabric Data Agent?
Is there any supported way to implement RLS for a Data Agent built directly on Lakehouse tables (without using a semantic model)?

Categories:

Autonomous agents

Hi RR-16041311-0

Thanks for outlining your scenario.

Current Behavior

RLS is not enforced when a Fabric Data Agent is connected directly to Lakehouse tables. RLS in Fabric currently works only through semantic models (Power BI datasets).

1. Is RLS enforced via Data Agent on Lakehouse tables?

No, there’s no automatic RLS enforcement in this setup.

2. Is there a supported way without a semantic model?

No, not natively supported today.

Recommended Options

Use a Semantic Model (Recommended):

Build a model on top of the Lakehouse and define RLS roles. This is the only secure, supported approach.

App-Level Filtering (Workaround):

Filter data in your custom portal using the logged-in user’s email and mapping table.

Requires strict handling to avoid security gaps.