Forum Discussion
Helper VQuery Firewall Violation
Hi rpiboy_1,
Thank you for the follow-up question. To clarify having a web call inside a function doesn’t by itself violate the firewall rules.
The firewall is triggered when:
• A value from one data source (e.g. admin API) is used to dynamically build or drive a request to another data source (e.g. object API).
• Power Query can’t guarantee that sensitive information from one source isn’t being sent to the other.
So technically, whether the Web.Contents is inside a function, or a “stand-alone” query doesn’t matter what matters is how the privacy levels are configured for the sources you’re combining. https://learn.microsoft.com/en-us/powerquery-m/web-contents
Function per server: You can safely parameterize the base URL (US, CA, etc.) in your function. If each function only calls one domain, the firewall won’t block it.
Separate queries per server, then roll up: This also works, but it’s more verbose. You’d then combine those queries later.
Both approaches are valid. The key is: if the endpoints are trusted and belong to the same system, set their Privacy Level to the same scope (e.g. Organizational). That way, the firewall won’t block cross-source logic whether it’s inside a function or separate queries.So the choice of “function vs. separate queries” is mostly about maintainability of your code rather than avoiding the firewall. The firewall decision is based on privacy settings, not function structure.
Hope this clears it up. Let us know if you have any doubts regarding this. We will be happy to help.
Thank you for using the Microsoft Fabric Community Forum.
Community SupportHi rpiboy_1,
Thank you for reaching out to the Microsoft Fabric Community Forum. Also, thanks to VahidDM, for his inputs on this thread.
Thanks a lot for sharing all the details and the code. I can see the amount of effort you have already put into this. The error you are seeing (Query Firewall Violation with “...rebuild this combination...”) isn’t about your M code being wrong, but rather how Power Query’s privacy firewall works.
What’s happening is:
• Your query pulls data from two different REST endpoints (adm-us/ca and api-us/ca).
• Power Query treats each endpoint as a separate data source.
• When you try to use data from one endpoint as input into the other, the firewall blocks it for privacy reasons.
This is why the step ObjectDataWithFunction is called out that’s where the combination is happening. Here couple of approaches mentioned below please try those:
Align Privacy Levels: In Power BI Desktop go to File > Options & Settings > Data Source Settings and make sure both endpoints are set to the same privacy level (for example, Organizational). You can also adjust this under File > Options > Privacy by choosing to ignore privacy levels for this file (use with caution, only if you fully trust both sources).
https://learn.microsoft.com/en-us/power-query/privacy-levels
If one query feeds into another, sometimes using Table.Buffer() on the first query breaks the “live link” that triggers the firewall. https://learn.microsoft.com/en-in/powerquery-m/table-buffer
Load the first API into a Power BI Dataflow, then call the second API in your report. Because the first dataset materialized in the service, the firewall doesn’t block the combination. https://learn.microsoft.com/en-us/power-bi/transform-model/dataflows/dataflows-introduction-self-service
If the endpoint lets you pull related data in one request (e.g., via an expand or include query parameter), that avoids the need for chaining two sources. The issue is not with your logic, but with how Power Query enforces privacy when combining multiple data sources. Adjusting the privacy settings or restructuring the queries should let you get past this.
Hope this clears it up. Let us know if you have any doubts regarding this. We will be happy to help.
Thank you for using the Microsoft Fabric Community Forum.
rpiboy_1I would love to use Dataflows, but in this case I'm building a PBI template for distribution to our customers to use to get their data from our SAAS solution. It seems like as much as I wanted to retain if/then logic around the different regional endpoints to my dismay I'm going to be forced to generate a unique query for each unique endpoint.
- v-kpoloju-msft
Hi rpiboy_1,
Thank you for the follow-up question. To clarify having a web call inside a function doesn’t by itself violate the firewall rules.
The firewall is triggered when:
• A value from one data source (e.g. admin API) is used to dynamically build or drive a request to another data source (e.g. object API).
• Power Query can’t guarantee that sensitive information from one source isn’t being sent to the other.
So technically, whether the Web.Contents is inside a function, or a “stand-alone” query doesn’t matter what matters is how the privacy levels are configured for the sources you’re combining. https://learn.microsoft.com/en-us/powerquery-m/web-contents
Function per server: You can safely parameterize the base URL (US, CA, etc.) in your function. If each function only calls one domain, the firewall won’t block it.
Separate queries per server, then roll up: This also works, but it’s more verbose. You’d then combine those queries later.
Both approaches are valid. The key is: if the endpoints are trusted and belong to the same system, set their Privacy Level to the same scope (e.g. Organizational). That way, the firewall won’t block cross-source logic whether it’s inside a function or separate queries.So the choice of “function vs. separate queries” is mostly about maintainability of your code rather than avoiding the firewall. The firewall decision is based on privacy settings, not function structure.
Hope this clears it up. Let us know if you have any doubts regarding this. We will be happy to help.
Thank you for using the Microsoft Fabric Community Forum.
- v-kpoloju-msft
Hi rpiboy_1,
Just checking in to see if the issue has been resolved on your end. If the earlier suggestions helped, that’s great to hear! And if you’re still facing challenges, feel free to share more details happy to assist further.Thank you.