Fabric data protection: masking vs row-level vs object-level security vs labels vs endorsement
Verdict: Hide rows by user with row-level security; hide whole columns or tables with object-level security; obscure values with dynamic data masking (inference-vulnerable); classify with sensitivity labels; signal trust with endorsement.
| Criterion | Row-level security | Object-level security | Dynamic data masking | Sensitivity labels | Endorsement |
|---|---|---|---|---|---|
| What it controls | Which rows a user sees | Whether whole tables or columns are visible | The displayed value of a column | Confidentiality classification | Trust and discoverability signal |
| Enforced at | SQL analytics endpoint compute, all SQL consumers | Semantic model | Warehouse column, query time | Information-protection policy | Catalog metadata |
| Use when | Regional managers see only their own rows | Contractors must not see compensation columns at all | Reduce accidental exposure of a value | Drive protection by classification | Mark the certified gold source |
| Key limitation | Filters rows, not columns | Hides schema objects, not row values | Query users can still infer values by range filtering | Classifies, does not filter data | No access effect at all |
Rules
- Row-level security on the SQL analytics endpoint filters rows for every direct SQL consumer, unlike DAX RLS which only covers the semantic model.
- Object-level security hides entire tables or columns; row-level security and masking cannot conceal a whole column.
- Dynamic data masking limits accidental exposure only; pair it with object or row-level controls because query users can infer values.
- Endorsement marks items Promoted or Certified to signal a trusted source; it does not restrict access.
- Fabric evaluates security in order: Entra authentication, then Fabric access, then data security.
- Use row-level security when entire rows must be hidden from some users while others keep full access.
Traps
- Sensitivity labels classify content; they do not filter rows or hide columns.
- DAX-based RLS in a semantic model does not protect direct SQL analytics endpoint queries.
- Changing the masking function does not close the inference gap; any masking is vulnerable to range probing.