Which Warehouse Object Implements Row-Level Security in Fabric?
You have a Fabric warehouse named DW1. DW1 contains a table that stores sales data and is used by multiple sales representatives. You plan to implement row-level security (RLS). You need to ensure that the sales representatives can see only their respective data. Which warehouse object do you require to implement RLS?
Community Insight
The question tests knowledge that RLS filtering logic lives in a schemabound inline table-valued FUNCTION used as a filter predicate — the trap is picking SCHEMA because RLS is often loosely described as organizing access.
Row-level security in a Microsoft Fabric warehouse is built from a user-defined function that returns a yes/no predicate for each row, which is then bound to the table through a security policy. This page confirms that the FUNCTION is the required warehouse object, and explains why schemas, constraints, and stored procedures do not provide RLS filtering.
The most common wrong choice is C (SCHEMA), because learners associate row filtering with organizing objects into security schemas; a schema only groups database objects and cannot evaluate USER_NAME() to allow or deny individual rows.
Community Discussion (9 comments)
Comments & Corrections
No comments yet — spotted an error or have a note? Share it below.
Expert Analysis
Why the Answer Is Correct
A FUNCTION is the required object because RLS in a Fabric warehouse is implemented by creating a user-defined inline table-valued function (for example, Security.tvf_securitypredicate) that returns a row only when USER_NAME matches the row's owner column. That function is then referenced as the FILTER PREDICATE of a CREATE SECURITY POLICY statement applied to the sales table, so each sales representative only sees their own rows. Without the predicate function there is nothing for the security policy to evaluate, making the function the indispensable warehouse object the question asks for. The official Microsoft tutorial for row-level security in the data warehouse follows exactly this sequence: define the function, then define the security policy.Why the Other Options Are Wrong
A SCHEMA (C) is only a logical container used to organize tables, procedures, and policies; creating a "Security" schema is a supporting step but it performs no row filtering on its own. A CONSTRAINT (B), such as CHECK or FOREIGN KEY, validates or relates data at write time and cannot vary its evaluation per connected user, so it cannot restrict rows by identity. A STORED PROCEDURE (A) can run imperative T-SQL, but RLS filtering must apply transparently to every query against the table, including ad-hoc SELECTs from reporting tools, which only a predicate function bound through a security policy guarantees. Stored procedures and schemas may appear in an RLS script, yet neither is the object that defines the row-access rule.Community Comment Notes
Every commenter selected D, with Adriel_1996 posting a full script that creates a schema, then a function, then a security policy, illustrating that the function carries the predicate logic. QAZdbarhate12345678 wrote that you "need to use a FUNCTION to define the filtering logic," and prabhjot noted you "create a predicate function which gets evaluated to filter user access to certain rows in a Yes or No manner." Tuki93 linked the Microsoft tutorial on defining security policies, while Mustafa_Shazly observed that a schema is used "to organize database objects only," which is precisely why C fails. The consensus matches the official documentation, so the community majority here is reliable.Official Reference
Exam Strategy
On DP-700 RLS questions, remember the two-object pattern: a predicate function defines the rule and a security policy applies it; if only one object is asked for, it is the function. Ignore objects that merely organize or validate data, since they cannot vary results by user identity.
Frequently Asked Questions
Why isn't a SCHEMA enough to implement row-level security in DW1?
A schema only groups database objects such as tables and policies; it has no logic that can test USER_NAME() and allow or deny individual rows of the sales table.
How does the RLS function relate to the security policy?
The function implements the filter predicate logic, and CREATE SECURITY POLICY binds that function to the table so every query is filtered automatically for the connected user.