Forum Discussion
Resolver IControlled "Semantic Model Execute Queries" REST API Access for Fabric Users
We want to enable the executeQueries endpoint for a large audience of users so that an application can execute DAX queries against a directlake model (with SSO enabled) on their behalf.
Enabling this endpoint poses a security risk because it allows users to access Fabric via unapproved tools. (Some are safe and helpful, but this can't be guaranteed.) The relevant tenant setting ("Semantic Model Execute Queries REST API") can be scoped to security groups, but it cannot limit incoming traffic to a specific source (our trusted application).
Fabric provides controls to limit inbound traffic - IP allow-lists, private links at the workspace level, conditional entra access policies, etc. We have reviewed the options on this page: About inbound access protection in Fabric - Microsoft Fabric | Microsoft Learn. Semantic models are not supported for most of these solutions (private links, for example), and even if they were, they seem like they would treat API access and portal access the same. Any setting that sufficiently restricts traffic to the API endpoint would also lock users out of the Fabric portal itself (or unnecessarily restrict data in the portal).
Have we missed anything? Is there a way to conditionally allow API access from specific sources for security groups without negatively impacting users by applying those same restrictions to standard portal access?
2 Replies
- svenchio
Super User
Yeah I hear you sean_cochran ! But unfortunately that is not possible with today's security model, currently you can’t say “allow this user’s Power BI token only to this item or when it comes from this trusted application”; the way forward is to change which identity is allowed to call the API, or to reconsider how much new risk the API actually adds and decide whether is the risk is acceptable base on the data and its sensitivity.
Furthermore, you also need to take in consideration that, whatever the tenant setting, Service Principals aren’t supported for datasets with RLS per RLS limitations or datasets with SSO enabled.
Not many option on this case, the only one that I can think of is to use a dedicated service user account and scope the “Semantic Model Execute Queries REST API” tenant setting to a group containing only that account and the flow would work like this...
#1. The user signs in to your app and gets an ordinary Entra token
#2. The app gets a Power BI token as the service account (e.g. [email protected])
#3. The app calls the API and names the end user.
POST https://api.powerbi.com/v1.0/myorg/groups/{workspaceId}/datasets/{datasetId}/executeQueries Authorization: Bearer <service account token> { "queries": [{ "query": "EVALUATE TOPN(10, Sales)" }], "impersonatedUserName": "[email protected]" }#4. Model applies user's row-level security (RLS) roles and returns only what she is allowed to see.
But there's some many "buts" that I can hardly see you guys going thru this path, I'm just want to give you options 😅
This is my cents on your post, hope you find some of this information useful; would it be nice a thumbs up and mark as solution if deemed appropriate.... wish you the very best.
- ibarrau
Hi. It's a tricky request. If you would let users check the same info, no RLS need, you can. I won't explain all again svenchio already did it perfectly.
My answer would be saying you could add an additional layer. Creating an azure function as a rest api endpoint that would do the request to the power bi rest api. You can check about entra id auth for azure function and then keep that auth for the rest.
As an alternative you could query the data with API for GraphQL at fabric to let users query specific tables too. Something like the following post (except that the post is not using entra id, you should read that by your own): https://blog.ladataweb.com.ar/exponer-datos-lakehouse-api-graphql/
I hope that helps,
