Semantic model ownership in a large organization

[MorelG]

Dear community,

I have a question regarding the ownership of semantic models in a large organization. Currently, all our semantic models are owned by individual users, even those that are placed in "Production" workspaces.

Now, let's consider the following scenarios:

1. When a user leaves the organization, the scheduled refreshes of their models start to fail.
2. Cloud connections are mostly linked to the owner's personal account.

What is the recommended approach to avoid these kinds of situations?

[sergej_og · Accepted solution]

Give permissions to the affected workspace(s) to user remaining in the company.
That users can "take over" the semantic models and afterwards (hopefully) renew the personal user-based cloud connections without issues. To renew personal use-based auth they need access to the sources of course.
Depends on how you have designed your access policies.

Regards.

[3CloudThomas · Accepted solution]

This is a similar issue with large on-premises analysis service systems.

Do not have the ownership as a user.

Instead, create a 'service account' in Azure Active Directory (I think it is called Entra Id now) that an Power BI administrator has the password for. You need to assign a Power BI Pro license to this new user. Login to app.powerbi.com with the 'service account' credentials and Take Over by this user. Now, you need to have the 'service account' granted permissions to data sources in order to refresh the data.

If a normal user deployes a new model, it will overwrite the model but not the credentials.

Some poeple might say use a service principal, but service principals cannot be granted access to data sources, so you are still stuck with the same problem. Others might say to use credentials in a Data Gateway, still use a 'service account' for this.

[pdolan_tapco]

What if you now have MFA, this limits the access of the service account to only one user, does anyone know of a solution for this? (or is this just job security)

[PrashantC]

We had some cases of "Microsoft Auth token refresh" which forced many of the model owners to refresh their credentials. I presume this would impact the service accounts too. Can such credential refresh be scrupted for all datsets owned by a user or service account?

[3CloudThomas]

The service account would have to have the MFA turned off. The IT Security or Infrastructure team would manage the credentials to insure no one uses the service account for anything else but the connection and semantic model ownership.

[MorelG]

@3CloudThomas, @sergej_og, Thank you, guys! Both of your answers confirmed our thoughts. We now need to decide whether to create 'technical accounts' and determine how many of these accounts we need, considering the cost of the PRO license. Alternatively, we could continue using personal accounts as owners, but we would need to establish proper governance for individuals who leave the organization.

[sergej_og · Accepted solution]

Give permissions to the affected workspace(s) to user remaining in the company.
That users can "take over" the semantic models and afterwards (hopefully) renew the personal user-based cloud connections without issues. To renew personal use-based auth they need access to the sources of course.
Depends on how you have designed your access policies.

Regards.