Composite Model - personal vs. shared cloud connection

[IMett]

Hi everyone,

I've built a composite model with an import mode part pointing to some on premise data sources, and a direct query part which fetches data from a published semantic model.

I understand that I need to connect the datasources to a gateway, which I did in the semantic model settings.

However I would actually like to use a shared cloud connection to Power BI Dataset, which doesn't work for me: all the visuals referring to the direct query model are broken with error messages:

However if I switch the gateway connection to "personal cloud connection", everything works fine.
While this is a workaround, I actually planned to leverage the shared cloud connection in this case, so that everybody in our team can become semantic model owner if needed, without the risk of breaking visuals because of missing personal cloud connections.

Did anyone encounter this issue and can give me a hint to the possible reasons?

[v-pgoloju]

Hi @IMett,

Great to hear that it's working as expected on your end!. I would suggest accepting your approach as the solution so that it can benefit others as well. It would be really helpful for others in the community who might be facing similar issues and can address them quickly.

Thanks & Regards,

Prasanna Kumar

[v-pgoloju]

Hi @IMett,

Just checking, have you had a chance to open a support ticket, as suggested. If so, we'd love to hear the current status or any updates from that.

If the issue was resolved through the support ticket, it would be great if you could share the solution here as well. It could really help other community members find answers more quickly.

Warm regards,
Prasanna Kumar

[IMett]

Hi @v-pgoloju 

I didn't open a support ticket so far, because I have found a solution for the actual problem (using Shared Cloud Connection with SSO). 
What I would appreciate is a documentation / explanation whether this is a design issue as proposed by @collinq or some kind of bug which might be solved in a future release.

[v-pgoloju]

Hi @IMett,

Thank you for reaching out to the Microsoft Fabric Forum Community, and special thanks to @MohdZaid_ , @Murtaza_Ghafoor and @collinq  for prompt and helpful responses.

If the issue still persists, I’d recommend raising a support ticket with Microsoft. The support team can look into the backend and provide more in-depth assistance tailored to your environment.
https://learn.microsoft.com/en-us/power-bi/support/create-support-ticket

Thanks & Regards,

Prasanna Kumar

[IMett]

Hi everyone,

Thank you for your reply. Honestly, I didn't fully understand your explanation yet.

A shared cloud connection defines which user credentials should be used to access the datasource. Right now, I entered my own credentials (via Oauth2 authentification), but I could also use a service principal there. 

Obviously, I do have build permissions on the upstream semantic model.
I would expect the shared cloud connection to act in the same way as on premise data gateway connections (which also work for direct query), so that the query to the underlying data source is executed with the stored credentials.

Am I wrong with this assumption?

The main reason to use the shared cloud connection are not missing permissions in this case, but rather that I don't want to explain to everyone how to create and configure personal cloud connections.

However I figured out today that if I activate the SSO checkbox, the visuals etc. work. So for this actual problem, this solution should work for me, although I still wonder why this has to be necessary.

Maybe someone of you can provide me a link to something from the documentation, which explains why the shared connection with stored credentials doesn't work, even if the stored credentials do have sufficient permissions.

[MohdZaid_]

Hey @collinq  , 

This issue happens in composite models in Microsoft Power BI when using DirectQuery to another semantic model (also called DirectQuery for Power BI datasets).

Why It Works with Personal Cloud Connection

When you use a Personal Cloud Connection, Power BI uses your own credentials and permissions to access the upstream semantic model. Since you likely have full access to that dataset, the visuals work correctly.

Why It Breaks with Shared Cloud Connection

With a Shared Cloud Connection, Power BI does not use your personal credentials. Instead, it relies on the connection identity configured in the workspace. If that shared connection does not have the required permissions to access the upstream semantic model, the DirectQuery visuals fail and appear broken.

Common reasons include:

1. Missing Build Permission - Users or the shared connection must have Build permission on the source semantic model.
2. Dataset Access Not Granted - The shared connection identity may not have access to the published semantic model used for DirectQuery.
3. Cross-Workspace Permissions - If the source semantic model is in another workspace, the shared connection must be allowed to access it.
4. Tenant / Admin Settings - Admin settings such as Allow live connections to Power BI datasets must be enabled.

Recommended Fix

Check the following steps:

1. Go to the source semantic model used in DirectQuery.
2. Open Manage Permissions.
3. Grant Build permission to the users or group that will use the shared cloud connection.
4. Ensure the semantic model is certified or promoted if used across workspaces.
5. Reconfigure the shared cloud connection and refresh the composite model.

If this explanation helped, please mark it as the solution so others can find it easily.

If it helped, a quick Kudos is always appreciated it highlights useful answers for the community.

Thanks for being part of the discussion!!!

[Murtaza_Ghafoor]

@IMett @collinq 

Why It Fails with Shared Cloud Connection:

When you switch to a Shared Cloud Connection, Power BI no longer uses your personal identity.

Instead, it uses a shared credential or service identity.

The problem is that DirectQuery to another Power BI semantic model usually requires the user’s identity to be passed through.

Because the shared connection cannot pass your user identity:

• The upstream semantic model cannot verify permissions.
• The query fails.
• The visuals show errors.

That’s why everything works with Personal Cloud Connection but breaks with Shared Cloud Connection.

Propose Solution:

For scenarios like yours, the best approach is usually:

Keep using user authentication (OAuth) instead of shared credentials.

Grant Build permission on the upstream dataset to the team.

This allows multiple team members to work with the semantic model without breaking the Direct Query connection.

If this helps, ✓ Mark as Kudos | Mark as Solution| Help Others

[collinq]

Hi @IMett ,

I think that is a designed issue.  A shared cloud connection uses credentials from the service.  But, a personal cloud uses model owner credentials.  They are treated as separate things with separate permissions.  So, it will continue to error.

The solution would be to use a Service Account to get around the model owner problem.  Or, you could use a live connection instead of a composite.  Or, you could import everything (which might not be realistic) into a Lakehouse or a Dataflow and then use that for your report.  Or, I think that if you gave every single user the appropriate access to the semantic model that should work (but I think that this might give more permissions than you want).