Forum Discussion

jaryszek's avatar
jaryszek
Super User
7 months ago
Solved

DirectLake over OneLake dataset with RLS or SSO Enabled?

Hello, https://learn.microsoft.com/en-us/rest/api/power-bi/datasets/execute-queries-in-group To use Service Principals, make sure the admin tenant setting Allow service principals to use Power ...
Need Help
  • jaryszek's avatar
    jaryszek
    6 months ago

    I explained the issue myself. 

    executeQeuries is working with DirectLake. The case is the auth. If you are authed like app only (service principal act as app only), executeQueries is not working. When you auth on behalf on user - it is working without any issues. 

    Best,
    Jacek

v-pnaroju-msft's avatar
v-pnaroju-msft
Community Support
7 months ago

Hi jaryszek,

Thank you for the followup, and please accept my apologies for any inconvenience caused.
According to the documentation, “Service Principals aren't supported for datasets with RLS per RLS limitations or datasets with SSO enabled,” which implies that Service Principals may use the Execute Queries API for datasets provided no RLS is defined and no data source with SSO is configured.
Datasets - Execute Queries In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn
The documentation does not explicitly list Direct Lake over OneLake semantic models as a limitation. Therefore, I stated: “If the semantic model is Direct Lake over OneLake, no RLS roles are defined, and the tenant setting ‘Allow service principals to use Power BI APIs’ is enabled, then Service Principal and the ExecuteQueries REST API are supported and function as designed. Direct Lake does not use data source SSO, so SSO is not applicable in this scenario.”
I sincerely apologize for any inconvenience caused if I misunderstood the limitation earlier.

Thank you.

jaryszek's avatar
jaryszek
Super User
7 months ago

Yes, but support thinks something else. 
Can you please contact me in private message and connect on Teams to explain this? 

Especially this statement:
"

  • Datasets that are hosted in Azure Analysis Services or that have a live connection to an on-premises Azure Analysis Services model aren't supported."


This means that DirectLake is not supported?

So in other words, Service Principal can run this query but not on DirectLake? 

And the next question about executeQueries json body:

{
  "queries": [
    {
      "query": "EVALUATE VALUES(MyTable)"
    }
  ],
  "serializerSettings": {
    "includeNulls": true
  },
  "impersonatedUserName": "[email protected]"
}


Why use impersonatedUserName? If this will enforce RLS ? 


Edit:
Answer from support:
When we create a Direct Lake mode dataset, it will by default use SSO to data source(SQL endpoint), when share report with other viewer, the triggered query to AS engine will use the sign-in user credential to run the "Discover OLS/RLS permission check query" which will be deny as this user have no ReadData permission to run the SELECT commands.

If anybody can explain this will be great

Best,
Jacek