Gold Layer + Semantic Model + Reporting - Security for TDA question

there is currently no single Microsoft document that describes this architecture end‑to‑end. However, the design pattern is possible when the relevant components are combined: Microsoft Fabric security, Direct Lake with a fixed (workspace) identity, semantic model RLS, OneLake security(Preview), and Microsoft Entra ID B2B. PFB references

 

due to access permission constraints and licensing limitations in our environment, we were unable reproduce at our end, could let us know if you could able achieve as below suggested? and also please refer some useful docs

 

 

 

 

Recommended approach: Use Microsoft Entra ID security groups for user personas (All, Power, Advanced, Master). External users can be onboarded via Entra ID B2B and added to the same groups for consistent access management.

For Gold → Semantic Model access, use a single fixed identity (workspace identity / service principal) that holds permissions on Gold Lakehouses. End‑user access is enforced via RLS in the semantic model, avoiding direct Gold access and permission sprawl while enabling cross‑workspace reuse.

OneLake security governs storage‑level access (data at rest) and does not replace semantic model RLS, which handles user‑level filtering.

Persona model: All Users view reports; Power Users build reports on semantic models; Advanced Users extend models with read access to Gold; Master Users have direct Gold access.

 

This aligns with Fabric security best practices: encryption at rest (OneLake), TLS in transit, and Entra ID–based service‑to‑service authentication.

 

 

 

Thanks,

Prashanth