Forum Discussion
Issue sharing report built off Databricks Mirrored Catalog
- 1 year ago
Hi jaredneedshelp,
You're encountering this issue because when using a Databricks mirrored catalog (or Lakehouse with shortcuts) in a Fabric workspace, the underlying Direct Lake mode enforces strict security at the data level. Even if users have access to the semantic model and report in a separate workspace, they still need explicit access to the Lakehouse that holds the mirrored catalog data. Simply assigning viewer permissions to the workspace containing the semantic model is not sufficient, as the Direct Lake connection attempts to query the source data directly from the lakehouse at runtime.To resolve this without granting full access to the original lakehouse workspace, you can assign item-level permissions to the Lakehouse itself (not the entire workspace) by sharing the lakehouse directly with the user group and granting them read access. This allows them to query the Direct Lake tables through the semantic model while keeping workspace-level access restricted. Alternatively, consider materializing key data into a new Lakehouse or using Import or DirectQuery mode as a workaround if security separation must be strictly enforced.
Hi ,As mentioned by the semantic model leverages single sign-on (SSO), which means that the identity that queries the semantic model (often a report user) is used to query the SQL analytics endpoint data.
You can create a sharable cloud connection (SCC) so that connections to the data source can be made with a fixed identity.
Manage Direct Lake semantic models - Microsoft Fabric | Microsoft Learn
Additionally,
If the semantic model absolutely requires a SQL endpoint but you don’t want users to access the full catalog, you can:
Create a new, separate SQL Analytics endpoint: Configure a dedicated SQL Analytics endpoint that only points to the views or specific shortcuts in the Mirrored Catalog, without exposing full access to the underlying tables.
If the responses has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.