Forum Discussion
Resolver IControlled "Semantic Model Execute Queries" REST API Access for Fabric Users
Super UserHi. It's a tricky request. If you would let users check the same info, no RLS need, you can. I won't explain all again svenchio already did it perfectly.
My answer would be saying you could add an additional layer. Creating an azure function as a rest api endpoint that would do the request to the power bi rest api. You can check about entra id auth for azure function and then keep that auth for the rest.
As an alternative you could query the data with API for GraphQL at fabric to let users query specific tables too. Something like the following post (except that the post is not using entra id, you should read that by your own): https://blog.ladataweb.com.ar/exponer-datos-lakehouse-api-graphql/
I hope that helps,
sean_cochranThanks for your input!
Respecting the exsiting RLS rules is a key requirement. Removing those rules would solve the application's problem, but it would not solve the organization's problem.
The azure function idea is interesting. I'm not sure a function would solve the problem, but exploring it did lead me to Azure's API management offering (which I did not know existed). Theoretically, we could setup a tenant-wide private link to restrict Fabric access to org-only, then pipe all org traffic through the APIM and deny access to all except the app and a few specified users. However, we would lose access to a long list of features and functionality that includes some non-negotiables like on-premises data gateways, capacity metrics, and email subscriptions.
Going directly to tables would be an option, but we'd lose the substantial amount of modelling work that has been done in the semantic models, and we still wouldn't have an easy way to decide which users should see what data.