Which feature enforces per-row access control in Fabric by evaluating a condition for each row?

• A. Dynamic Data Masking
• B. Audit policy
• C. Security predicate function
• D. Row-level encryption

Answer: (C)

Security predicate function is used to enforce per-row access control by evaluating a condition for every row during query evaluation. This function references the current user, their roles, or session context and applies a boolean test to each row. If the predicate returns true, the row is visible; if false, it’s filtered out. This creates dynamic, row-level filtering so each user only sees the rows they’re authorized to see.

Dynamic Data Masking, by contrast, hides sensitive values in the result set rather than filtering which rows are accessible. Audit policy records access events rather than restricting data visibility. Row-level encryption protects data at rest and does not perform per-row visibility decisions during queries.