You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
:::image type="content" source="media/row-level-security/row-level-security-graphic.png" alt-text="Decorative graphic of row level security.":::
24
24
25
-
Row-Level security enables you to use group membership or execution context to control access to rows in a database table.
25
+
Row-level security (RLS) enables you to use group membership or execution context to control access to rows in a database table.
26
26
27
-
Row-Level security (RLS) simplifies the design and coding of security in your application. RLS helps you implement restrictions on data row access. For example, you can ensure that workers access only those data rows that are pertinent to their department. Another example is to restrict customers' data access to only the data relevant to their company.
27
+
Row-level security simplifies the design and coding of security in your application. RLS helps you implement restrictions on data row access. For example, you can ensure that workers access only those data rows that are pertinent to their department. Another example is to restrict customers' data access to only the data relevant to their company.
28
28
29
29
The access restriction logic is located in the database tier rather than away from the data in another application tier. The database system applies the access restrictions every time that data access is attempted from any tier. This makes your security system more reliable and robust by reducing the surface area of your security system.
30
30
31
31
Implement RLS by using the [CREATE SECURITY POLICY](../../t-sql/statements/create-security-policy-transact-sql.md)[!INCLUDE [tsql](../../includes/tsql-md.md)] statement, and predicates created as [inline table-valued functions](../../relational-databases/user-defined-functions/create-user-defined-functions-database-engine.md).
32
32
33
33
Row-level security was first introduced to [!INCLUDE [sssql16-md](../../includes/sssql16-md.md)].
34
34
35
+
> [!NOTE]
36
+
> This article is focused on [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] and Azure SQL platforms. For [!INCLUDE [fabric](../../includes/fabric.md)], see [Row-level security in Microsoft Fabric](/fabric/data-warehouse/row-level-security).
37
+
35
38
## <aid="Description"></a> Description
36
39
37
40
Row-level security (RLS) supports two types of security predicates:
@@ -685,7 +688,7 @@ DROP SCHEMA Sample;
685
688
686
689
We can demonstrate row-level security [!INCLUDE [fabricdw](../../includes/fabric-dw.md)] and [!INCLUDE [fabricse](../../includes/fabric-se.md)] in [!INCLUDE [fabric](../../includes/fabric.md)].
687
690
688
-
The following example creates sample tables that will work with [!INCLUDE [fabricdw](../../includes/fabric-dw.md)] in [!INCLUDE [fabric](../../includes/fabric.md)], but in [!INCLUDE [fabricse](../../includes/fabric-se.md)] use existing tables. In the [!INCLUDE [fabricse](../../includes/fabric-se.md)], you cannot `CREATE TABLE`, you can `CREATE SCHEMA`, `CREATE FUNCTION`, and `CREATE SECURITY POLICY`.
691
+
The following example creates sample tables that will work with [!INCLUDE [fabricdw](../../includes/fabric-dw.md)] in [!INCLUDE [fabric](../../includes/fabric.md)], but in [!INCLUDE [fabricse](../../includes/fabric-se.md)] use existing tables. In the [!INCLUDE [fabricse](../../includes/fabric-se.md)], you cannot use `CREATE TABLE`, but you can use`CREATE SCHEMA`, `CREATE FUNCTION`, and `CREATE SECURITY POLICY`.
689
692
690
693
In this example, first create a schema `sales`, a table `sales.Orders`.
691
694
@@ -723,7 +726,7 @@ Create a `Security` schema, a function `Security.tvf_securitypredicate`, and a s
723
726
-- Creating schema for Security
724
727
CREATESCHEMASecurity;
725
728
GO
726
-
729
+
727
730
-- Creating a function for the SalesRep evaluation
728
731
CREATEFUNCTIONSecurity.tvf_securitypredicate(@SalesRep AS nvarchar(50))
729
732
RETURNS TABLE
@@ -745,13 +748,13 @@ After applying the security policy and creating the function, the users `Sales1@
A view is a virtual table whose contents are defined by a query. Like a table, a view consists of a set of named columns and rows of data. Unless indexed, a view does not exist as a stored set of data values in a database. The rows and columns of data come from tables referenced in the query defining the view and are produced dynamically when the view is referenced.
17
19
18
20
A view acts as a filter on the underlying tables referenced in the view. The query that defines the view can be from one or more tables or from other views in the current or other databases. Distributed queries can also be used to define views that use data from multiple heterogeneous sources. This is useful, for example, if you want to combine similarly structured data from different servers, each of which stores data for a different region of your organization.
19
21
20
-
Views are generally used to focus, simplify, and customize the perception each user has of the database. Views can be used as security mechanisms by letting users access data through the view, without granting the users permissions to directly access the underlying base tables of the view. Views can be used to provide a backward compatible interface to emulate a table that used to exist but whose schema has changed. Views can also be used when you copy data to and from [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] to improve performance and to partition data.
22
+
Views are generally used to focus, simplify, and customize the perception each user has of the database. Views can be used as security mechanisms by letting users access data through the view, without granting the users permissions to directly access the underlying base tables of the view. Views can be used to provide a backward compatible interface to emulate a table that used to exist but whose schema has changed. Views can also be used when you copy data to and from [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] to improve performance and to partition data.
21
23
22
-
## Types of Views
23
-
Besides the standard role of basic user-defined views, [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] provides the following types of views that serve special purposes in a database.
24
+
## Types of views
25
+
26
+
Besides the standard role of basic user-defined views, [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] provides the following types of views that serve special purposes in a database.
24
27
25
-
Indexed Views
28
+
### Indexed views
29
+
26
30
An indexed view is a view that has been materialized. This means the view definition has been computed and the resulting data stored just like a table. You index a view by creating a unique clustered index on it. Indexed views can dramatically improve the performance of some types of queries. Indexed views work best for queries that aggregate many rows. They are not well-suited for underlying data sets that are frequently updated.
27
31
28
-
Partitioned Views
29
-
A partitioned view joins horizontally partitioned data from a set of member tables across one or more servers. This makes the data appear as if from one table. A view that joins member tables on the same instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] is a local partitioned view.
32
+
### Partitioned views
33
+
34
+
A partitioned view joins horizontally partitioned data from a set of member tables across one or more servers. This makes the data appear as if from one table. A view that joins member tables on the same instance of [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] is a local partitioned view.
30
35
31
-
System Views
32
-
System views expose catalog metadata. You can use system views to return information about the instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] or the objects defined in the instance. For example, you can query the sys.databases catalog view to return information about the user-defined databases available in the instance. For more information, see [System Views (Transact-SQL)](../../t-sql/language-reference.md)
36
+
### System views
37
+
38
+
System views expose catalog metadata. You can use system views to return information about the instance of [!INCLUDE [ssNoVersion](../../includes/ssnoversion-md.md)] or the objects defined in the instance. For example, you can query the `sys.databases` catalog view to return information about the user-defined databases available in the instance. For more information, see [System Views (Transact-SQL)](../../t-sql/language-reference.md).
33
39
34
-
## Common View Tasks
40
+
## Common view tasks
41
+
35
42
The following table provides links to common tasks associated with creating or modifying a view.
|Describes how to return information about a view such as the view definition.|[Get Information About a View](../../relational-databases/views/get-information-about-a-view.md)|
45
52
|Describes how to rename a view.|[Rename Views](../../relational-databases/views/rename-views.md)|
46
53
47
-
## See Also
48
-
[Create Views over XML Columns](../../relational-databases/xml/create-views-over-xml-columns.md)
The login identification number of the user. *server_user_id*, which is optional, is **int**. *server_user_id* can be the login identification number of any [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] login or Windows user or group that has permission to connect to an instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)]. When *server_user_id* isn't specified, the login identification name for the current user is returned. If the parameter contains the word NULL, it will return NULL.
46
+
The login identification number of the user. *server_user_id*, which is optional, is **int**. *server_user_id* can be the login identification number of any [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)] login or Windows user or group that has permission to connect to an instance of [!INCLUDE[ssNoVersion](../../includes/ssnoversion-md.md)]. When *server_user_id* isn't specified, the login identification name for the current user is returned. If the parameter contains the word `NULL`, it returns `NULL`.
47
47
48
48
## Return type
49
49
50
50
**nvarchar(128)**
51
51
52
52
## Remarks
53
53
54
-
`SUSER_NAME` returns a login name only for a login that has an entry in the `syslogins` system table.
54
+
`SUSER_NAME` returns a login name only for a login that has an entry in the `sys.server_principals` or `sys.sql_logins` catalog views.
55
55
56
56
`SUSER_NAME` can be used in a select list, in a WHERE clause, and anywhere an expression is allowed. Use parentheses after `SUSER_NAME`, even if no parameter is specified.
57
57
@@ -60,13 +60,40 @@ The login identification number of the user. *server_user_id*, which is optional
60
60
61
61
## Examples
62
62
63
+
### A. Use SUSER_NAME
64
+
63
65
The following example returns the login identification name of the user with a login identification number of `1`.
64
66
65
67
```sql
66
68
SELECT SUSER_NAME(1);
67
69
```
68
70
69
-
## See also
71
+
### B. Use SUSER_NAME without an ID
72
+
73
+
The following example finds the name of the current user without specifying an ID.
74
+
75
+
```sql
76
+
SELECT SUSER_NAME();
77
+
GO
78
+
```
79
+
80
+
In SQL Server, here is the result set for a Microsoft Entra ID authenticated login:
81
+
82
+
```output
83
+
contoso\username
84
+
```
85
+
86
+
In Azure SQL Database and Microsoft Fabric, here is the result set for a Microsoft Entra ID authenticated login:
0 commit comments