Forum Discussion

PowerNewUser's avatar
PowerNewUser
Icon for Resolver I rankResolver I
2 years ago
Solved

OneLake Data Access + Live Connection = No Access in reports.

I recently enabled Data access roles in my lakehouse but cant get downstream users to access reports (they get errors on the visuals related to access). Would appreciate if anybody could help with what I'm missing!


- I have given access to the entra security groups directly on the lakehouse as READ. 

- I have tried adding the groups to an "alltables" role with direct assignment as well as lakehouse permission rule based assignment. 

- Default role was removed. 

- my other lakehouse without data access roles seems to be working just fine.. so am guessing its something to do with my setup. 

 

Reports are setup with a semantic model leveraging a live connection to the lakehouse. 

I can see the reports just fine as admin (have workspace level access). End users get the following on each visual - 

The SELECT permission or external policy action 'Microsoft.Sql/Sqlservers/Databases/Schemas/Tables/Rows/Select' was denied on the object....

 

Do I need to add all tables to the default semantic model? Do I need to grant/deny access in the SQL Endpoint as well? (Copilot had that suggestion)

Need Help

3 Replies

  • Anonymous's avatar
    Anonymous
    Not applicable
    2 years ago

    Hi PowerNewUser ,

     

    Could you check whether the user has access rights to all of the following items?

    1\ Semantic Model

    2\ LakeHouse

    3\ SQL analytics endpoint

    4\ Report

     

    You can check the user's permissions by clicking "Manage Permissions" on each item.

     

     

     

     

     

     

    Best Regards,

    Wearsky

    • PowerNewUser's avatar
      PowerNewUser
      Icon for Resolver I rankResolver I
      2 years ago

      Thank you.. With the new preview ReadData is not showing up even when you select the option. 

  • PowerNewUser's avatar
    PowerNewUser
    Icon for Resolver I rankResolver I
    2 years ago

    Figured out the problem - seems copilot was on the right track. Due to enabling the preview the READDATA is no longer coming up as a permission. I had to manually go in and give access to the schema 

    GRANT SELECT ON SCHEMA::dbo TO [<entra group>];  
    GO
    if you need to give table level access - you can do 
    GRANT SELECT ON OBJECT::dbo.<table name> TO [<entra group name>];