You have a Fabric workspace named Workspace1 that contains a lakehouse named Lakehouse1. Lakehouse1 contains the following tables: - Orders - Customer - Employee The Employee table contains…

Sharing Lakehouse1 with the data engineer before migrating the Employee table would grant them access to the PII within the Employee table, violating the security requirement.

Assigning the data engineer the Contributor role for Workspace2, which would contain the migrated Employee PII table, would grant them elevated permissions to view that sensitive data, violating the requirement.

Assigning the data engineer the Viewer role for Workspace2, which would contain the Employee PII table, would still allow them to view the sensitive data, violating the requirement.

After migrating the Employee table, assigning the data engineer the Contributor role for Workspace1 grants them the necessary permissions to write to the Customer table in Lakehouse1, which no longer contains the sensitive PII.

Migrating the Employee table from Lakehouse1 to Lakehouse2 is crucial for isolating the PII data, enabling separate access controls and ensuring the data engineer cannot inadvertently view sensitive information when working in Lakehouse1.

Creating a new workspace named Workspace2 that contains Lakehouse2 establishes a distinct security boundary for the sensitive Employee PII table, allowing for granular permission management separate from where the data engineer needs to work.

Assigning the data engineer the Viewer role for Workspace1 would not provide the necessary permissions for them to write data to the Customer table, which is a key part of their workflow.