Every lakehouse gets this OneLake security role, which lets anyone with ReadAll permission read all of its data. If you add stricter roles without editing it or removing people from it, those people still have full access.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains DefaultReader in context, with comparison tables and the common traps.
Terms in this definition
- Lakehouse
Fabric storage item in OneLake that holds structured and unstructured content side by side: managed Delta tables go under Tables, other files under Files. Spark is used for processing, and a read-only SQL analytics endpoint allows T-SQL queries.
- OneLake security
Access control for data in OneLake. Lakehouse roles can allow read or read-write access as narrowly as a single folder, schema, table, row or column, and every engine reading the data, from Spark to the SQL analytics endpoint and Direct Lake, applies them.
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- ReadAll
Grants access to lakehouse or warehouse data through Spark, OneLake APIs and the explorer pane. Querying with T-SQL is a separate permission, ReadData.
- CRUD
Shorthand for create, read, update and delete, the four basic things you do with data. Data-plane roles in Azure Cosmos DB, for instance, authorise those operations on items.
- ALL
A DAX function that ignores any filters and gives back every row of a table or every value of the named columns. Used within CALCULATE, it works as a modifier that clears filters, although REMOVEFILTERS states that intent more clearly where it is available.
- Architecture Definition Document
A key deliverable bringing together the main architecture artifacts across the four domains for every relevant state: baseline, transition and target. It sets out, in qualitative terms, what the architect intends.
- Full Access
A permission in Exchange Online that allows a delegate to open another person's mailbox and read, create or delete items in it. It does not allow sending messages as or for the owner; that requires Send As or Send on Behalf.