A semantic model feature that conceals entire tables or columns from a role's members, so they can't even see what exists; it is configured through TMDL view or Tabular Editor. For a SQL database the same term means object permissions set with GRANT and DENY.
Also called OLS.
Read more: Microsoft Learn
In the Ultra Transcenders books
Each book explains Object-level security in context, with comparison tables and the common traps.
Terms in this definition
- Semantic model
Sometimes called an OLAP model, this Power BI and Fabric layer defines the measures, hierarchies, tables and relationships that reports and dashboards query; star schema design is the usual pattern.
- Role
How an actor normally or expectedly behaves, or the part a person takes in a process. A single actor may hold more than one role.
- TMDL view
Lets you script, edit and apply semantic model metadata as TMDL code, in Power BI Desktop or (preview) the service. Some objects, like perspectives or object-level security, can only be edited this way.
- Serverless
Compute tier for single Azure SQL databases that scales automatically, pauses when idle and charges by the second. It is offered in General Purpose and Hyperscale, not Business Critical, and reserved capacity does not apply.
- Schema
The middle part of a Unity Catalog name (
catalog.schema.table), grouping tables, views, volumes, functions and models inside a catalog. A grant on it covers everything in it now and later, and nothing inside can be reached withoutUSE SCHEMA. - AGDLP
Nesting pattern: users go into global groups, which go into domain local groups, which receive the permissions. AGUDLP adds universal groups for forests with several domains.
- Set
Secret permission in Key Vault for writing secrets; some older material refers to it as Create.
- Authorisation code
OAuth 2.0 grant used by native and web apps: the user signs in, and the app then acts on their behalf with delegated permissions.
Related terms
- Viewer
Holders can look at workspace content and query data via warehouses or SQL analytics endpoints, yet can't change anything. Semantic model RLS and OLS apply to them. It's the lowest-privilege workspace role.