onelake-security

Manage OneLake data access roles (row/column-level security)

Authentication scope: fabric

list

List data access roles for an item

fabio onelake-security list --workspace <value> --id <value>

Flag	Type	Required	Description
--workspace	string	Yes	Workspace ID
--id	string	Yes	Item ID (e.g., lakehouse ID)

Read-only · Returns list

show

Show details of a data access role

fabio onelake-security show --workspace <value> --id <value> --role-name <value>

Flag	Type	Required	Description
--workspace	string	Yes	Workspace ID
--id	string	Yes	Item ID
--role-name	string	Yes	Data access role name

Read-only · Returns object

create

Create or update a single data access role

fabio onelake-security create --workspace <value> --id <value> --role <value>

Flag	Type	Required	Description
--workspace	string	Yes	Workspace ID
--id	string	Yes	Item ID
--role	string	Yes	Role definition as JSON or path to JSON file (prefix with @)
--conflict-policy	enum	No	Conflict policy when role already exists (Abort or Overwrite)

Mutates state · Returns object

upsert

Replace all data access roles for an item (atomic PUT)

fabio onelake-security upsert --workspace <value> --id <value> --roles <value>

Flag	Type	Required	Description
--workspace	string	Yes	Workspace ID
--id	string	Yes	Item ID
--roles	string	Yes	Roles definition as JSON (array of role objects) or path to a JSON file (prefix with @)

Examples

fabio onelake-security upsert --workspace $WS --id $LH --content '[{"name":"AnalystRole","members":[{"principalId":"...","principalType":"User"}],"decisionRules":[{"effect":"Permit","paths":["Tables/sales"]}]}]'

Mutates state · Returns object

delete

Delete a data access role

fabio onelake-security delete --workspace <value> --id <value> --role-name <value>

Flag	Type	Required	Description
--workspace	string	Yes	Workspace ID
--id	string	Yes	Item ID
--role-name	string	Yes	Data access role name to delete

Mutates state · Destructive · Returns void