DirectLake over OneLake dataset with RLS or SSO Enabled?

Hi jaryszek,

Thank you for your inquiry submitted via the Microsoft Fabric Community Forum.

Based on my understanding, Service Principals are not supported for executing queries against semantic models that have Row Level Security (RLS) or data source Single Sign On (SSO) enabled, because both require evaluation of an actual user identity, whereas a Service Principal represents an application identity.

Please note that an SSO enabled dataset refers to data source SSO (delegation of user identity to data sources such as Azure SQL, SAP or Snowflake in DirectQuery scenarios), and not to Power BI sign-in. Direct Lake over OneLake does not use or support data source SSO, as it reads Delta files directly from OneLake.

To check SSO for non-Direct Lake models, navigate to Semantic model → Settings → Data source credentials. If OAuth or Kerberos with the “Use SSO” option is configured, SSO is enabled.

RLS exists only if it has been explicitly created. Verify its presence in Power BI Desktop via Modeling → Manage roles, or in the Service via Semantic model → Security. If no roles are defined, RLS is not present.

Please follow the approach below which may help resolve the issue:

1. Using a Service Principal with the Execute Queries API against a Direct Lake (OneLake) semantic model is a valid approach provided that no RLS is defined.

Additionally, please refer to the links below:
Direct Lake overview - Microsoft Fabric | Microsoft Learn
Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn
Overview of single sign-on for on-premises data gateways - Power BI | Microsoft Learn

If you require support for Service Principal with RLS or SSO, we request that you submit an idea on the Ideas portal at: https://ideas.fabric.microsoft.com.

We hope this information helps to resolve your issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.