Forum Discussion

stellahe102's avatar
stellahe102
Icon for Helper II rankHelper II
2 days ago

Red Flag in SQL Analytics EndPoint - User Identity Access Mode

We are seeing some red flags when switching the default access mode "Delegated" to ""User's Identity" in a SQL Analytics EndPoint of lakehouse, but seeing red flags with message not relevant to the u...
one lake
security
v-achippa's avatar
v-achippa
Icon for Community Support rankCommunity Support
1 day ago

Hi stellahe102​,

Thank you for reaching out to Microsoft Fabric Community.

The warning is caused by the source DefaultReader group not being mapped to the downstream lakehouse.

Please grant the same DefaultReader group Read permission on LH2 and then run Metadata sync. Keep the User's identity access mode enabled.

If the warning still appears after the sync, please verify that DefaultReader is a standard Microsoft Entra security group and not a mail enabled security group or distribution list.

Thanks and regards,
Anjan Kumar Chippa

  • stellahe102's avatar
    stellahe102
    Icon for Helper II rankHelper II
    1 day ago

    Hi v-achippa​ thanks for your reply! if you don't mind, some follow-up questions:

    The DefaultReader group is inherited from the source Lakehouse (LH1) and should not need to be granted access again in the downstream Lakehouse (LH2), as we need to maintain curated access group in the downstream workspace.

    From a design perspective, why would central/power users who already have access to the source Lakehouse need to be explicitly added to the consumer's Lakehouse (LH2)?

    We also performed additional testing and found that the issue is not limited to AD groups. The error message references any user or group from other business group that has access to the same table in the source Lakehouse (LH1) prior to LH2, we cannot give access to those users who are not intended consumers of LH2

    Can you help explain why LH2 validates or checks access assignments that exist in the source Lakehouse (LH1)? What is the relationship between the downstream Lakehouse and the source Lakehouse's user/group permissions that causes those source-level user/group to appear in the error message?