M365.FM - Modern work, security, and productivity with Microsoft 365
Microsoft Fabric DP‑600: Row-Level Security, Object-Level Security & The 3 Secrets Of Incremental Refresh Explained
May 5, 2025 · 1 hr 29 min · Season 1 · 64.5 MB
0:00-1:29:34
Streams straight from the publisher. podnod never proxies or re-hosts episode audio.
(00:00:00) Understanding row-level security
(00:15:53) Exploring object-level security
(00:30:12) Benefits of incremental refresh
(00:38:19) Optimizing Power BI performance
(00:57:41) Enhancing analysis with visuals
(01:05:06) Ensuring data quality
(01:15:44) Unlocking insights with T-SQL
Most teams “turn on” incremental refresh and hope for the best—then wonder why refresh windows creep into business hours, capacity throttles spike, or sensitive RLS/OLS rules quietly break at scale. In this episode, we take your DP‑600 training from theory to reality: starting with a financial‑services scenario where unsecured sales data triggered real concern, and showing how row‑level security (RLS), object‑level security (OLS), and incremental refresh must be designed together—not bolted on separately. You’ll see why unsecured data isn’t just a technical issue but a business and compliance risk, how RLS and OLS protect confidentiality, and how the right incremental‑refresh pattern keeps large Fabric datasets fast, affordable, and auditable instead of becoming a ticking time bomb.
SECRET 1 – RLS: STOP PRETENDING “EVERYONE CAN SEE EVERYTHING
” IS OKRow‑level security is the first line of defense: it decides which rows each user is allowed to see, turning generic reports into personalized, confidential views. We walk through real‑world breach scenarios—salary leaks, overexposed sales numbers, and “who else can see my data?” client questions—and show how proper RLS in Power BI and Fabric could have prevented them by restricting access based on roles and identities. You’ll learn which personas actually need what (marketing, sales, executives), how RLS supports GDPR and industry regulations, and a step‑by‑step pattern for building, testing, and publishing RLS‑enabled reports so teams get only the data they’re supposed to see.
SECRET 2 – OLS: WHEN “NOT EVEN KNOWING THE TABLE EXISTS” MATTERS
If RLS is the fence, Object‑Level Security is the vault: it hides entire tables or columns from users who shouldn’t even know they exist. In this segment, we go beyond row filters and show why sensitive structures—payroll tables, HR dimensions, specific financial attributes—must be protected at the object level, especially in industries like finance, healthcare, and government. You’ll hear how OLS complements RLS, how it prevents “metadata leaks” where users infer confidential structures from model diagrams, and why combining both is the only way to fully align with strict compliance rules while still enabling analytics. We also discuss where OLS belongs in your DP‑600 skill set and how to bring it into your solution designs instead of treating it as an afterthought.
SECRET 3 – INCREMENTAL REFRESH: PERFORMANCE WITHOUT BREAKING SECURITY
The third secret is that incremental refresh is not just a performance trick—it’s part of your security and compliance story. We explain how to design range and archive windows so large datasets stay responsive, how to avoid common pitfalls (like forgetting to align RLS filters with date partitions), and why poorly planned refresh policies can expose more data than intended or silently fail under growth. You’ll get a practical mental model for combining incremental refresh with RLS and OLS: how to parameterize ranges, test policies with realistic volumes, and ensure that as data ages into history, it remains both queryable and properly secured. By the end, you’ll know how to answer the DP‑600 exam questions—and, more importantly, how to keep your own Fabric solutions from collapsing when real data and real stakeholders show up.
WHAT YOU’LL LEARN
The core insight of this episode is that performance and security in Fabric are inseparable: incremental refresh that ignores RLS and OLS just gives you fast, scalable leaks. When you design row‑ and object‑level security first, then layer incremental refresh on top, you move from “hoping” data is safe to proving it—with clear roles, smaller attack surfaces, and refresh behavior you can explain to auditors and stakeholders. That’s the real DP‑600 mindset shift: every optimization must be grounded in confidentiality and compliance, or it doesn’t count.
WHO THIS EPISODE IS FOR
Mirko Peters is a Microsoft 365 and data platform consultant and host of the M365.FM podcast, helping organizations treat Microsoft 365, Fabric, and their analytics stack as one integrated operating system instead of disconnected tools. He works with teams in finance, services, and other regulated industries to design architectures, governance, and security models—RLS, OLS, and incremental refresh included—that protect sensitive data while still enabling fast, trustworthy analytics.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.
(00:15:53) Exploring object-level security
(00:30:12) Benefits of incremental refresh
(00:38:19) Optimizing Power BI performance
(00:57:41) Enhancing analysis with visuals
(01:05:06) Ensuring data quality
(01:15:44) Unlocking insights with T-SQL
Most teams “turn on” incremental refresh and hope for the best—then wonder why refresh windows creep into business hours, capacity throttles spike, or sensitive RLS/OLS rules quietly break at scale. In this episode, we take your DP‑600 training from theory to reality: starting with a financial‑services scenario where unsecured sales data triggered real concern, and showing how row‑level security (RLS), object‑level security (OLS), and incremental refresh must be designed together—not bolted on separately. You’ll see why unsecured data isn’t just a technical issue but a business and compliance risk, how RLS and OLS protect confidentiality, and how the right incremental‑refresh pattern keeps large Fabric datasets fast, affordable, and auditable instead of becoming a ticking time bomb.
SECRET 1 – RLS: STOP PRETENDING “EVERYONE CAN SEE EVERYTHING
” IS OKRow‑level security is the first line of defense: it decides which rows each user is allowed to see, turning generic reports into personalized, confidential views. We walk through real‑world breach scenarios—salary leaks, overexposed sales numbers, and “who else can see my data?” client questions—and show how proper RLS in Power BI and Fabric could have prevented them by restricting access based on roles and identities. You’ll learn which personas actually need what (marketing, sales, executives), how RLS supports GDPR and industry regulations, and a step‑by‑step pattern for building, testing, and publishing RLS‑enabled reports so teams get only the data they’re supposed to see.
SECRET 2 – OLS: WHEN “NOT EVEN KNOWING THE TABLE EXISTS” MATTERS
If RLS is the fence, Object‑Level Security is the vault: it hides entire tables or columns from users who shouldn’t even know they exist. In this segment, we go beyond row filters and show why sensitive structures—payroll tables, HR dimensions, specific financial attributes—must be protected at the object level, especially in industries like finance, healthcare, and government. You’ll hear how OLS complements RLS, how it prevents “metadata leaks” where users infer confidential structures from model diagrams, and why combining both is the only way to fully align with strict compliance rules while still enabling analytics. We also discuss where OLS belongs in your DP‑600 skill set and how to bring it into your solution designs instead of treating it as an afterthought.
SECRET 3 – INCREMENTAL REFRESH: PERFORMANCE WITHOUT BREAKING SECURITY
The third secret is that incremental refresh is not just a performance trick—it’s part of your security and compliance story. We explain how to design range and archive windows so large datasets stay responsive, how to avoid common pitfalls (like forgetting to align RLS filters with date partitions), and why poorly planned refresh policies can expose more data than intended or silently fail under growth. You’ll get a practical mental model for combining incremental refresh with RLS and OLS: how to parameterize ranges, test policies with realistic volumes, and ensure that as data ages into history, it remains both queryable and properly secured. By the end, you’ll know how to answer the DP‑600 exam questions—and, more importantly, how to keep your own Fabric solutions from collapsing when real data and real stakeholders show up.
WHAT YOU’LL LEARN
- Why unsecured data (like open sales figures and salaries) is a business, legal, and trust risk—not just an IT issue.
- How Row‑Level Security (RLS) works in Fabric/Power BI and which stakeholders benefit from properly scoped roles.
- Where Object‑Level Security (OLS) is mandatory to hide full tables/columns in sensitive industries.
- How to implement and test RLS in Power BI Desktop and Power BI Service as part of your DP‑600 skill set.
- How to design incremental refresh policies that scale performance without undermining RLS and OLS.
- A practical checklist to combine RLS, OLS, and incremental refresh into one coherent security and performance model.
The core insight of this episode is that performance and security in Fabric are inseparable: incremental refresh that ignores RLS and OLS just gives you fast, scalable leaks. When you design row‑ and object‑level security first, then layer incremental refresh on top, you move from “hoping” data is safe to proving it—with clear roles, smaller attack surfaces, and refresh behavior you can explain to auditors and stakeholders. That’s the real DP‑600 mindset shift: every optimization must be grounded in confidentiality and compliance, or it doesn’t count.
WHO THIS EPISODE IS FOR
- Microsoft Fabric and Power BI professionals preparing for the DP‑600 Analytics Engineer exam.
- Data engineers and BI developers responsible for securing large Fabric models with RLS and OLS.
- Security, compliance, and risk teams worried about who can see what inside analytics platforms.
- Consultants and architects designing Fabric solutions where performance, privacy, and regulation must all align.
Mirko Peters is a Microsoft 365 and data platform consultant and host of the M365.FM podcast, helping organizations treat Microsoft 365, Fabric, and their analytics stack as one integrated operating system instead of disconnected tools. He works with teams in finance, services, and other regulated industries to design architectures, governance, and security models—RLS, OLS, and incremental refresh included—that protect sensitive data while still enabling fast, trustworthy analytics.
Become a supporter of this podcast: https://www.spreaker.com/podcast/m365-fm-modern-work-security-and-productivity-with-microsoft-365--6704921/support.