Fabric Lakehouse Permissions

[dimitragav10_]

Hello everyone,

I have a question regarding permissions in Microsoft Fabric.

I typically work with Power BI and SSRS reports, and I want to give viewers access to view these reports without granting them permission to query the underlying endpoints.

For example, I have a Lakehouse named "Lakehouse1" in the workspace WS_Lakehouse. I created a Paginated Report based on this Lakehouse and published it in the WS_Reports workspace. In WS_Lakehouse, I am the only one with access, while in WS_Reports, there’s a group with the "Viewer" role.

My question is: What permissions should I assign to the Lakehouse so that viewers in WS_Reports can see the report but not access the SQL endpoint of the Lakehouse? Or, is there another way (e.g., through a service principal) to ensure that users can only view the report and cannot perform further actions?

Thank you,
Dimitra

[v-priyankata]

Hi @dimitragav10_ 
I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please Accept it as a solution and give it a 'Kudos' so others can find it easily.
Thank you

[v-priyankata]

Hi @dimitragav10_ 
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.

[v-priyankata]

Hi @dimitragav10_ 

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[rohit1991]

Hi @dimitragav10_ ,

Users in WS_Reports with the Viewer role can only view reports but won’t have access to the underlying Lakehouse1 unless explicitly granted. Ensure they are not added to WS_Lakehouse.

Do not grant direct permissions on Lakehouse1 to report viewers.If using a Power BI dataset, store credentials in the dataset to avoid direct access from users.

By default, only those with explicit permissions can query the SQL endpoint. Ensure that no one in WS_Reports has any direct role in WS_Lakehouse to prevent unauthorized querying. If needed, deny SQL endpoint access explicitly via workspace security settings.

Use a Service Principal for Secure Data Access. Instead of granting direct user access, use a Service Principal or Managed Identity to fetch data for reports. Configure Paginated Reports to use a predefined identity with controlled access. Row-Level Security (RLS): If applicable, use RLS to control data visibility based on user roles. Data Gateway (if needed): If your data source is on-premises, ensure the gateway is configured correctly with stored credentials.

 

 

 

"The goal is to turn data into information, and information into insight." – Carly Fiorina

🔗 Need Power BI help? Connect on LinkedIn: Rohit Kumar’s LinkedIn

[dimitragav10_]

Thank you for your response @rohit1991 .

I attempted to upload a report without granting permissions on the Lakehouse, but viewers were unable to access the report unless I provided "Read" access to the Lakehouse. Once I grant access, the report works as expected, but viewers can also access the SQL Endpoint.

This issue is particularly evident when creating a Power BI report with Lakehouse connection, as users can open the semantic model and retrieve the SQL endpoint. 

Am I possibly overlooking something here?

[v-priyankata · Accepted solution]

HI @dimitragav10_ 
if the report connects directly to the Lakehouse, users will require Read access to the Lakehouse, which also grants access to the SQL endpoint.
If a Power BI dataset is used, implement RLS to restrict data visibility per user.

Thank you.