A "Lakehouse" in a "Microsoft Fabric" workspace stores several folders of files, and a group of data scientists who already hold the Viewer workspace role must be allowed to read only one specific folder of those files through OneLake, while remaining blocked from the other folders. Which approach grants that folder-scoped read access most directly?
- APromote the data scientists to the Contributor workspace role so their elevated role lets them reach the single folder they need inside the Lakehouse.
- BApply row-level security filters on the semantic model built over the Lakehouse so the data scientists only see rows sourced from the permitted folder.
- CCreate a OneLake data access role on the Lakehouse that grants read permission scoped to the specific folder and assign the data scientists to that role. Correct
- DUse item-level sharing to share the whole Lakehouse with the data scientists, relying on the share dialog to limit them to the one folder.
Why A is wrong: Contributor raises rights across the whole workspace and all Lakehouse data, which over-grants access and still does not scope reading to one folder.
Why B is wrong: Row-level security restricts rows returned by a semantic model, not direct OneLake file access to a folder, so it does not control reading the files themselves.
Why C is correct: OneLake data access roles define read permissions scoped to chosen folders or tables, so a role over just that folder grants exactly the targeted file access required.
Why D is wrong: Sharing the Lakehouse item grants access to the item broadly and the share dialog does not carve out individual folders, so it cannot enforce folder-level scoping.