Organizational access to Azure Data Warehouse Query Without Gateway or Workspace Access

[MarkPalmberg]

I have a paginated report sitting in a workspace for which I've created an app. The data source for the report is a SQL query against our Azure data warehouse. One audience in my app is premissioned to my entire organization. Everyone in the organization can *load* the paginated report, but users without workspace access get this error when trying to run it:

Users who are in a group with access to my workspace are able to load *and* run the report. The datasource for the report is a personal cloud connection using a system user account.

I *could* create a new data gateway for my data source, but I suspect that the VNet we're using is causing performance issues with our reports, so I'm trying to avoid that option until I can't. 

I'd also rather not grant workspace access to the entire org, though I understand this would probably resolve my current issue.

Is there a way to enable all users in my org to run this report without creating a data gateway entry for the data source (supposedly not needed for cloud data sources) and without giving the entire org access -- even at View -- to my workspace?

[v-veshwara-msft]

Hi @MarkPalmberg ,
Just wanted to check if the provided response by @nilendraFabric  has resolved your query. If so please mark the helpful reply as Accepted solution to help others benefit in the community. If still need assistance , please reach out.
Thank you.

[nilendraFabric · Accepted solution]

Hello @MarkPalmberg 

The core issue stems from how Power BI handles data source authentication and workspace permissions in app-based distribution. When users run a paginated report, two separate permissions are required:
1. Report Access (via the app)
2. Data Source Access (via workspace/data source configuration)
Your setup creates a permissions gap because:
• Organizational users can access the report through the app
• The personal cloud connection credentials aren’t inherited by app users
• Azure Data Warehouse requires explicit authentication that isn’t propagating through the app

Try this:

Create an Azure AD service principal with read-only SQL permissions on Azure Data Warehouse.
• In Power BI, configure the dataset connection to use service principal authentication (client ID + certificate).

In Power BI dataset settings:
• Set data source authentication to OAuth2 (Azure AD).
• Enable “Report viewers use their own credentials” to force Azure AD passthrough.

Map users/groups to RLS roles in the dataset to filter data dynamically.

Use certificate-based authentication (not secrets) for the service principal to avoid token expiration.

Grant users App access (Viewer role) in the workspace.
• Add the service principal as a Contributor to the workspace.

hope this helps 

[MarkPalmberg]

Thanks for the reply, @nilendraFabric . We have an Azure Entra service account, but it's not set up as a "service principal" in our Fabric tenant; I'll have to read up on how those 2 things differ.