You have a Fabric capacity that contains a workspace named Workspace1. Workspace1 contains a lakehouse named Lakehouse1, a data pipeline, a notebook…

The most effective and precise way to meet all requirements is to use item-level sharing for the Lakehouse. Sharing Lakehouse1 directly with User1 and granting the Read all SQL endpoint data permission achieves the specific goals. This permission allows User1 to connect to the SQL analytics endpoint and run SELECT queries on all tables, fulfilling the primary requirement. Crucially, this method does not grant permissions to the Lakehouse explorer or the underlying files for Apache Spark access. Furthermore, because this is an item-specific permission, it does not grant any access to other items within Workspace1, such as notebooks or pipelines, thus adhering to the principle of least privilege.

B. Assigning the Viewer role for Workspace1 grants read-only access to all items in the workspace, which directly violates the requirement to prevent access to other items.

C. The Build reports on the default semantic model permission is primarily for creating Power BI content. It does not grant the necessary SELECT permissions on tables for direct ad-hoc SQL analysis.

D. Assigning the Member role for Workspace1 grants excessive permissions, including the ability to edit and publish content, which violates the requirement to prevent access to other items.

---

1. Microsoft Fabric Documentation

"Share your warehouse and manage permissions." This document details the specific permissions available when sharing a Lakehouse or Warehouse. It explicitly states: "Read all SQL endpoint data: This permission grants read access to the SQL analytics endpoint. This permission allows users to connect to the SQL analytics endpoint and read data from all the tables and views in the Lakehouse." This directly supports option A as the correct way to grant SQL-only read access.

Source: Microsoft Learn

learn.microsoft.com/en-us/fabric/data-warehouse/share-warehouse-manage-permissions#share-a-warehouse-or-lakehouse

2. Microsoft Fabric Documentation

"Workspace roles." This document outlines the capabilities of each workspace role. It specifies that the Viewer role "can view all items in the workspace" and "can't connect to SQL analytics endpoints for lakehouses or warehouses." This confirms that options B and D are incorrect because they grant access to all workspace items

and the Viewer role (in option B) is insufficient on its own for SQL access.

Source: Microsoft Learn

learn.microsoft.com/en-us/fabric/get-started/roles-workspaces#workspace-roles

3. Microsoft Fabric Documentation

"Permissions for the SQL analytics endpoint in Microsoft Fabric." This page clarifies the relationship between workspace roles

item permissions

and SQL granular permissions. It reinforces that for SQL-only access without workspace-level visibility

direct sharing of the Lakehouse with the appropriate SQL endpoint permission (Read all SQL endpoint data) is the correct approach.

Source: Microsoft Learn

learn.microsoft.com/en-us/fabric/data-warehouse/sql-endpoint-security#permissions