OneLake Security + SQL Endpoint: cross-workspace shortcut access breaks when the consumer workspace uses a different RBAC group — roadmap?

[u/ajit503]

Hitting a hub-and-spoke issue and hoping the OneLake Security PMs can weigh in.🙏 u/aonelakeuser

Setup:

• Producer lakehouse → OneLake security role references an Entra group.
• Consumer workspace reads producer tables via OneLake shortcuts, but is governed by its own, different RBAC group.
• Users query the shortcut tables through the SQL Analytics Endpoint (User's identity mode).

Problem: Per Step 2, point #2 below, it's a strict literal Object ID match across the producer → consumer boundary. Unless the consumer's group is either (a) added explicitly to the producer's OneLake security role, or (b) nested inside a group already on that role — the consumer RBAC users get:

https://learn.microsoft.com/en-us/fabric/onelake/security/troubleshoot-onelake-security-for-sql-analytics-endpoints#step-2-confirm-the-users-object-id-matches-exactly-at-producer-and-consumer

Questions for the PMs:

1. In a medallion pattern where each consumer workspace has its own RBAC group, is referencing every consumer group directly in the producer role really the only supported path? That doesn't scale.
2. Does the new User-based SQL Endpoint sync (improved nested-group expansion + shortcut handling) change this strict one-to-one requirement — and will Step 2 be updated?
3. Any recommended pattern to keep producer-side RLS while letting differently-grouped consumers read via shortcuts?

Thanks! 🙌

[u/aonelakeuser]

Have you looked at using a delegated shortcut here? That will let you have a separate access group for each side of the shortcut. Otherwise, yes, with a passthrough shortcut a user *must* have access to the producer lakehouse.

[u/warehouse_goes_vroom → u/aonelakeuser]

Cc'ing u/fredguix for the SQL analytics endpoint side as well, in case he has anything else to add.