Forum Discussion
Help with semantic model and RLS in Fabric
On my lab i'm created a workspace and lakehouse and in lakehouse i created a sample table and model semantic.
In semantic model i created the function RLS and create auto-report too.
I do permission just in report but the RLS is not working if i don't create another connection such as OAuth2.0 or Workspace Identity.
On connection OAuth2.0 the connection is lost on every updete, but in workspace identity the RLS is working with success.
My question is this is standard platform behavior; do I really need to create a connection for RLS to work or Default SSO is enough?
Hi Anonymous ,
Thank you for reaching out to the Microsoft Community Forum.
Hi Jai-Rathinavel , Thank you for your prompt response.
Hi Anonymous ,The error "Fields that need to be fixed you don't have required permissions"
refer that, semantic model cannot query lakehouse, NOT an RLS problem and it's authentication problem.Please refer below architecture.
Lakehouse --> Semantic Model (RLS defined here) (Workspace Identity) --> Report --> Users (no lakehouse access)
Note: You need Workspace Identity. Default SSO alone is not sufficient when using RLS and hiding lakehouse access.I hope this information helps. Please do let us know if you have any further queries.
Regards,
Dinesh
6 Replies
Anonymous Default SSO is enough. Inorder for the RLS to work you have to add the users to both Security Layer and Report. Once the RLS roles are created on the semantic model follow the below steps.
1. Go to the semantic model in service -> Click on three dots
2. Click Security
3. Select the Role and Add the users accordingly
4. Give access to the user on the report layer too.
Hi Jai-Rathinavel Good Morning!
So in mi test when i create the semantic model and the connection is Default SSO i have this error
The report visualization just work if the user have access in lakehouse or if i change de Dafault SSO Connection to Workspace Identity or Cloud Connections.
Now i changed the connectionNow the same report with error above now its working with rls
I read in this blog that way is the most security way to share report with RLS, thats statment is correclty?
https://blog.fabric.microsoft.com/en-us/blog/support-for-workspace-identity-authentication-and-trusted-access-to-adls-gen2-in-semantic-models?ft=Fabric-platform:categoryHi Anonymous ,
Thank you for reaching out to the Microsoft Community Forum.
Hi Jai-Rathinavel , Thank you for your prompt response.
Hi Anonymous ,The error "Fields that need to be fixed you don't have required permissions"
refer that, semantic model cannot query lakehouse, NOT an RLS problem and it's authentication problem.Please refer below architecture.
Lakehouse --> Semantic Model (RLS defined here) (Workspace Identity) --> Report --> Users (no lakehouse access)
Note: You need Workspace Identity. Default SSO alone is not sufficient when using RLS and hiding lakehouse access.I hope this information helps. Please do let us know if you have any further queries.
Regards,
Dinesh
Hey! What you’re seeing is actually normal in Fabric, even if it’s a bit confusing at first.
RLS needs to know who the user is when querying the model, and that depends on the connection type. With the “default” setup, that identity isn’t always passed correctly, so RLS doesn’t apply. That’s why:
- With OAuth2.0: it works, but can break after refresh due to token issues
- With Workspace Identity: works consistently (that’s why you’re seeing success here)
So yes, in practice you do need a proper connection method for RLS to work reliably. Default SSO alone is not always enough in Fabric scenarios.
If you want something stable, I’d stick with Workspace Identity 👍
Hope that help!
