All labs
Governance & Security · Fabric · Guided simulation · 40 min
RLS on a Direct Lake semantic model
Regional managers must only see their region, but the model must stay in Direct Lake mode.
Implementation challenges · 0/3
1. Create the mapping table
user_email → region in the Lakehouse.
2. Define the role in the model
DAX filter on the mapping with USERPRINCIPALNAME().
3. Check fallback behaviour
Set DirectLakeBehavior = DirectLakeOnly and verify queries succeed.
Expected result
Each test user sees exactly one region; no fallback events.
Validation tests
- View-as returns single region
- No DirectQuery fallback in trace
Anti-patterns reviewers look for
- Defining RLS on the SQL endpoint for Direct Lake
- Static roles per region