Forum Discussion
Identity setup nuances | Semantic Model | Fabric-native architecture
Hi ankurarora1418 ,
Your understanding is mostly accurate. Workspace Identity enables secret-free access for Fabric native Direct Lake semantic models over Fabric Warehouses or SQL Endpoints, but this is limited to outbound data access. Inbound operations such as XMLA, REST APIs, or CI/CD automation will still require their own authenticated identities.
For deployments, Workspace Identity must be set up and granted permissions in each environment, as it is a workspace level configuration and does not automatically transfer with the semantic model.
With Direct Lake fallback to DirectQuery, Workspace Identity is designed to facilitate access to the underlying Fabric data source, provided the necessary permissions are in place on the Warehouse or SQL Endpoint. However, please note that fallback execution context may differ depending on configuration, so it should not be assumed that it always operates under the querying user's identity.
Thank you.
Please find the answers below to the best of my known capability.
1. For the workspace identity. I think that applies as long as you have created the semantic model under the context of that workspace identity or you take it over with the workspace identity. You can also use a single workspace identity across multiple workspaces. You will just have to add that workspace identity to each workspace where you want it to work.
2. With regard to the ALM and pipelines. You can use it as mentioned before with the same workspace identity across multiple workspaces.
3. With regards to the DQ fall back, my understanding is this always uses the users. Details when querying the semantic models.