Forum Discussion
Issue sharing report built off Databricks Mirrored Catalog
I have a fabric workspace with a databricks mirrored catalog, which is basically a lakehouse with shortcuts. I have created a new semantic model based off the sql analytics endpoint attached to the lakehouse and a report in a different fabric workspace. I have granted a group viewer on the workspace with the semantic model and report but they get an error viewing the report saying they don't have permission to view the contents of Direct Lake Table. How can I share the report with them, without adding them to the workspace with my lakehouse? I specifically want them to have access to the provided semantic model and report.
Hi jaredneedshelp,
You're encountering this issue because when using a Databricks mirrored catalog (or Lakehouse with shortcuts) in a Fabric workspace, the underlying Direct Lake mode enforces strict security at the data level. Even if users have access to the semantic model and report in a separate workspace, they still need explicit access to the Lakehouse that holds the mirrored catalog data. Simply assigning viewer permissions to the workspace containing the semantic model is not sufficient, as the Direct Lake connection attempts to query the source data directly from the lakehouse at runtime.To resolve this without granting full access to the original lakehouse workspace, you can assign item-level permissions to the Lakehouse itself (not the entire workspace) by sharing the lakehouse directly with the user group and granting them read access. This allows them to query the Direct Lake tables through the semantic model while keeping workspace-level access restricted. Alternatively, consider materializing key data into a new Lakehouse or using Import or DirectQuery mode as a workaround if security separation must be strictly enforced.
7 Replies
Hi jaredneedshelp,
You're encountering this issue because when using a Databricks mirrored catalog (or Lakehouse with shortcuts) in a Fabric workspace, the underlying Direct Lake mode enforces strict security at the data level. Even if users have access to the semantic model and report in a separate workspace, they still need explicit access to the Lakehouse that holds the mirrored catalog data. Simply assigning viewer permissions to the workspace containing the semantic model is not sufficient, as the Direct Lake connection attempts to query the source data directly from the lakehouse at runtime.To resolve this without granting full access to the original lakehouse workspace, you can assign item-level permissions to the Lakehouse itself (not the entire workspace) by sharing the lakehouse directly with the user group and granting them read access. This allows them to query the Direct Lake tables through the semantic model while keeping workspace-level access restricted. Alternatively, consider materializing key data into a new Lakehouse or using Import or DirectQuery mode as a workaround if security separation must be strictly enforced.
Thanks, I will look into this
mirrored is not the same as shortcuts. Please clarify your setup.
When you create a Databricks Mirrored Catalog what it is doing under the hood is using metadata from databricks to create shortcuts to your azure storage where the delta tables actually reside. But the "lakehouse" object is a Databricks Mirrored Catalog. My issue is when I create a semantic model off of the sql endpoint I can't share it with people without giving them access to the original endpoint. I just want them to have access to the data I put in the new semantic model.
Since you are using DirectLake mode, if the users do not have permissions on the lakehouse, then you may need to change the model's default cloud connection, which uses SSO to a shareable cloud connection. Please see the link below.
Manage Direct Lake semantic models - Microsoft Fabric | Microsoft Learn
Thanks, I will look into this
Hi ,As mentioned by the semantic model leverages single sign-on (SSO), which means that the identity that queries the semantic model (often a report user) is used to query the SQL analytics endpoint data.
You can create a sharable cloud connection (SCC) so that connections to the data source can be made with a fixed identity.
Manage Direct Lake semantic models - Microsoft Fabric | Microsoft LearnAdditionally,
If the semantic model absolutely requires a SQL endpoint but you don’t want users to access the full catalog, you can:Create a new, separate SQL Analytics endpoint: Configure a dedicated SQL Analytics endpoint that only points to the views or specific shortcuts in the Mirrored Catalog, without exposing full access to the underlying tables.
If the responses has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.
