You have a Fabric warehouse named DW1. DW1 contains a table that stores sales data and is used by multiple sales representatives. You plan to…

Row-Level Security (RLS) in a Microsoft Fabric warehouse is implemented by creating a security policy that applies a filter predicate to a table. This predicate logic, which determines whether a user can access a specific row, must be encapsulated within an inline table-valued function (TVF). The function evaluates each row against the current user's context (e.g., USERNAME()) and returns a result that the security policy uses to either show or hide the row. Therefore, a function is the essential T-SQL object required to define the core filtering logic for RLS.

A. STORED PROCEDURE: Stored procedures are used to execute pre-compiled sets of T-SQL statements, not to define the continuous, row-by-row filtering logic required by an RLS security policy.

B. CONSTRAINT: Constraints (e.g., CHECK, PRIMARY KEY) are used to enforce data integrity and rules on the data itself, not to control user access to specific rows.

C. SCHEMA: A schema is a container for organizing database objects and managing object-level permissions (e.g., GRANT SELECT ON SCHEMA::Sales), not for implementing row-level filtering.

1. Microsoft Fabric Documentation

"Row-level security in Fabric data warehousing": This official guide explicitly lists the steps for implementing RLS. Step 2 is: "Create an inline table-valued function to define the filter predicate." This confirms that a function is a required component.

Source: Microsoft Learn

learn.microsoft.com/en-us/fabric/data-warehouse/row-level-security

Section: "Implement row-level security in Fabric Warehouse".

2. Microsoft T-SQL Documentation

"CREATE SECURITY POLICY (Transact-SQL)": The official syntax and documentation for creating the security policy itself show that the ADD FILTER PREDICATE clause requires the name of a function. The documentation states

"The predicate is an inline table-valued function that is bound to the target table."

Source: Microsoft Learn

learn.microsoft.com/en-us/sql/t-sql/statements/create-security-policy-transact-sql?view=sql-server-ver16

Section: "Arguments"

subsection for [ FILTER PREDICATE = ].

3. Microsoft Azure Synapse Analytics Documentation

"Row-Level Security": As Fabric Warehouse is built upon the Synapse engine

this documentation is also applicable. It provides a complete example where a function (dbo.fnsecuritypredicate) is created first to hold the logic before the security policy is applied.

Source: Microsoft Learn

learn.microsoft.com/en-us/azure/synapse-analytics/sql-data-warehouse/sql-data-warehouse-row-level-security

Section: "Step 2: Create a function to filter the rows".