Forum Discussion
Post PatronSecurity of PowerBI - Fixed identity + RLS
Dears,
I am thinking in applying RLS to my semantic model which is build on (directlake)
This will make users (entra-id groups) be subject to RLS when they access the PBI report
I know this is configured in the semantic model itself (RLS)
But I would like that the semantic model, when accessing the data to return to the PBI would do it via fixed identity instead of having to provide viewer permissions to the user groups in the lakehouse
Weher is the place where I say that the semantic model (built using Directlake) needs to connect to the lakehouse using the worskpace identity ?
Is this done as well in the semantic model? where?
Thanks a lot,
Pedro
Hi fabricpribeiro,
Thank you for posting your query in the Microsoft Fabric Community Forum.This scenario is supported with Direct Lake. By default, a Direct Lake semantic model uses Single Sign-On (SSO), which means the report viewer’s identity is used to read data from the Lakehouse this is why users typically need permissions on the Lakehouse.
If you want the Semantic Model to access the Lakehouse using a fixed identity (so users don’t need direct Lakehouse permissions), you need to configure this in the Semantic Model connection settings, not in RLS.
Go to Workspace → Semantic Model → Settings → Gateway and Cloud Connections and Create a new Cloud Connection (for example using Workspace Identity) and Turn **Microsoft Entra SSO** to **Disabled** (this forces the fixed workspace identity for all queries and refreshes) and Bind your semantic model to this new cloud connection instead of the default “Single Sign-On”.
For more details, please refer to the official documentation:
Integrate Direct Lake Security - Microsoft Fabric | Microsoft Learn
Create and Share Cloud Data Sources in the Power BI Service - Power BI | Microsoft Learn
Connect to cloud data sources in the Power BI service - Power BI | Microsoft Learn
Best regards,
Ganesh Singamshetty.
8 Replies
- arabalca
Super User
I understand that you have created the semantic model yourself using a gold layer storage (this can be a Lakehouse, Warehouse, or any Fabric storage). In this case, you will need to implement Row-Level Security (RLS) at the Lakehouse level through the SQL endpoint.
The user will inherit the permissions you assign.
You can check how this type of security is defined in the official Microsoft Fabric documentation:
https://learn.microsoft.com/en-us/fabric/data-warehouse/row-level-security
Give it a try and let us know how it goes.
fabricpribeirosorry, I am not getting..
When I create a lakehouse and can after request as well the creation of a semantic model. Which I did with the option of Directlake (not import nor DirectQuery)
I can , in the semantic model, if I am not wrong, create RLS.
Till here, I believe everything is ok
Now, what I want is that the comunication between my semantic model and the lakehouse itself is done via fixed identity
Like:
Lakehouse - fixed identity - semantic model - RLS - PoweBI - User
I believe this is doable
But I don't know where, in th semantic model, do I configure the fixed identity (workspace identity) so that data is consumed via this way
I mean this : Setting up RLS on a Direct Lake semantic model
I think the answer is there , I just need to edit the SM and shift the way it connects
v-ssriganeshCommunity Support
Hi fabricpribeiro,
Thank you for posting your query in the Microsoft Fabric Community Forum.This scenario is supported with Direct Lake. By default, a Direct Lake semantic model uses Single Sign-On (SSO), which means the report viewer’s identity is used to read data from the Lakehouse this is why users typically need permissions on the Lakehouse.
If you want the Semantic Model to access the Lakehouse using a fixed identity (so users don’t need direct Lakehouse permissions), you need to configure this in the Semantic Model connection settings, not in RLS.
Go to Workspace → Semantic Model → Settings → Gateway and Cloud Connections and Create a new Cloud Connection (for example using Workspace Identity) and Turn **Microsoft Entra SSO** to **Disabled** (this forces the fixed workspace identity for all queries and refreshes) and Bind your semantic model to this new cloud connection instead of the default “Single Sign-On”.
For more details, please refer to the official documentation:
Integrate Direct Lake Security - Microsoft Fabric | Microsoft Learn
Create and Share Cloud Data Sources in the Power BI Service - Power BI | Microsoft Learn
Connect to cloud data sources in the Power BI service - Power BI | Microsoft Learn
Best regards,
Ganesh Singamshetty.- fabricpribeiro
Is it like this ? or do I need to disable something additionally?
- fabricpribeiro
Did you had the opportunity to see my question? thanks a lot
- v-ssriganesh
Hello fabricpribeiro,
Thank you for sharing the screenshots. the cloud connection configuration you created (Workspace identity with SSO unchecked) is valid.As per the official documentation, Direct Lake semantic models read data directly from OneLake using the effective identity (Microsoft Entra ID / SSO), and they don’t rely on gateway or connection credentials to access Delta tables.
This means:
- Your current setup is correct from a connection perspective.
- There is no additional option to disable.
- The Direct Lake model will still use user identity (SSO) to access the Lakehouse.
So the behavior you are expecting (forcing workspace/fixed identity for Direct Lake access) is not controlled through this configuration.
For more details, please refer to: Solved: Security of PowerBI - Fixed identity + RLS - Microsoft Fabric Community
I hope this clarifies the behavior. If the issue persists, we suggest you raise a Microsoft Support Ticket: Microsoft Fabric Support and Status | Microsoft Fabric
- v-ssriganesh
Hello fabricpribeiro,
We hope you're doing well. Could you please confirm whether your issue has been resolved or if you're still facing challenges? Your update will be valuable to the community and may assist others with similar concerns.
Thank you.
- v-ssriganesh
Hello fabricpribeiro,
Hope everything’s going great with you. Just checking in has the issue been resolved or are you still running into problems? Sharing an update can really help others facing the same thing.
Thank you.
