What is the recommended approach to enforce row-level security in Unity Catalog for external BI tool

[GaneshI]

We connect Tableau and Power BI to our Databricks SQL warehouse via OAuth tokens. Does Unity Catalog row filters apply at the SQL layer regardless of the BI tool, or do we need additional enforcement at the warehouse level?

[Lu_Wang_ENB_DBX · Accepted solution]

Unity Catalog row filters apply at the SQL/query layer, so if Tableau or Power BI is querying a Databricks SQL warehouse, the filters are enforced there — you do not need a separate warehouse-level row-filter feature. Row filters and column masks are evaluated at query time and integrate with standard SQL.

The key consideration is which identity the OAuth token represents:

• If the BI connection uses user OAuth / U2M, the filters apply per user.
• If it uses service principal OAuth / M2M, enforcement still happens, but it is evaluated as the service principal, so all BI users effectively share that principal’s data scope unless you add per-user delegation upstream.

Summary: No extra warehouse-level enforcement is needed for UC row filters themselves; make sure you use the right auth model for the level of per-user isolation you want.