Forum Discussion
Resolver IConfirming why user can't access direct lake semantic model data
I want to confirm my understanding of why Workspace Viewer access is sufficient to see lakehouse data via a SQL endpoint but NOT sufficient to access the exact same data via a Direct Lake semantic model.
Observed behavior that kicked off this misadventure:
- Workspace A contains a lakehouse
- Workspace B contains a Direct Lake semantic model (based on lakehouse in Workspace A) and report based on it
- Direct Lake semantic model in workspace B is based on AzureStorage.DataLake, not Sql.Database
- User has workspace viewer role on workspace A
- User has workspace contributor role on workspace B
- User sees a 'permission denied' error when attempting to open the report/model in workspace B
Relevant Fabric Docs re: Workspace Viewer Permissions
- Fabric docs state that users with viewer access can:
- Connect to SQL analytics endpoint of Lakehouse or the Warehouse
- Read Lakehouse and Data warehouse data and shortcuts2 with T-SQL through TDS endpoint (ReadData).
- Fabric docs also state that users with viewer access cannot:
- Read Lakehouse and Data warehouse data and shortcuts2 through OneLake APIs and Spark (ReadAll).
Based on the behavior and docs above - even though users with Viewer access on workspace A can see data in Lakehouses in workspace A via SQL endpoints, they cannot access lakehouse data in workspace A via a Direct Lake semantic model because Direct Lake models (those based on AzureStorage.DataLake, anyway) make API calls to the lakehouse, which are disallowed for workspace viewers.
Am I understanding this correctly? It seems odd that the same settings would result in different behavior depending on how you try to access data.
Hi sean_cochran
Accessing the Lakehouse & Direct lake models with Workspace role are bit confusing to users. As per your post, your understanding is correct and you're confused becuase direct lake models and SQL analytics endpoint uses different access paths into the same data
Actually, viewrs from Workspace able to see the data via SQL analytics endpoint through the TDS protocal. As per you mentioned viewr has ReadData permission.
While coming to diret lake model, it doesn't query the SQL end point. It conencts directly to one lake storage layer. SO if u eed to access this, you should have ReadAll access.
Finally, I would tell you that, Viewer role of workspace can query the data via SQL endpoint and can't query via Direct lake models.
Hope you are clear.
Thank you!!
Did I answer your question? Mark my post as a solution!
Proud to be a Super User!
2 Replies
- suparnababu8
Super User
Hi sean_cochran
Accessing the Lakehouse & Direct lake models with Workspace role are bit confusing to users. As per your post, your understanding is correct and you're confused becuase direct lake models and SQL analytics endpoint uses different access paths into the same data
Actually, viewrs from Workspace able to see the data via SQL analytics endpoint through the TDS protocal. As per you mentioned viewr has ReadData permission.
While coming to diret lake model, it doesn't query the SQL end point. It conencts directly to one lake storage layer. SO if u eed to access this, you should have ReadAll access.
Finally, I would tell you that, Viewer role of workspace can query the data via SQL endpoint and can't query via Direct lake models.
Hope you are clear.
Thank you!!
Did I answer your question? Mark my post as a solution!
Proud to be a Super User! 
v-prasareCommunity Support
We would like to confirm if our community members answer resolves your query or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are happy to help you.
Thank you for your patience and look forward to hearing from you.
Best Regards,
Prashanth Are
MS Fabric community support