Forum Discussion
Setting up a shareable cloud connection to a semantic model
Shared source will let developers to build new semantic models, publish and keep a single standard configuration for the refreshes. That only works for refresh data and nothing else. Then you still need to make sure the user that has access to a report also can read the semantic model. I don't think you can get rid of that. Maybe there is a trick for import but for direct query sounds almost impossible.
If you would really really want to separate that. Forget for ever of the semantic model permission for users. I guess the best alternative is embedding in ISV. Embedded software will configure all that for a single service principal and become owners of the distribution and login. They keep who can se what report (assign people manually to report) and forget about models. An example would be https://www.pibi.cloud
I hope that make sense
Thanks for the reply!
We do use Entra ID Security groups on all our products, we never authorized an individual user.
The thing is, the models in workspace A are master models, used in many workspaces/reports. All with different audiences. So even with using Entra ID security groups it would still become unmanageable at some point. Especially when access also needs to be maintained (removing groups from the model) on the models in workspace A.
I'm looking for a solution as shown in this video from Guy (Gal) in a Cube: Using fixed Identity
Super UserThat example is showing two semantic models at the same workspace. Shows how to create a shared connection to a Fabric Data Warehouse that could be use for any semantic model. Probably direct lake or import connection at models. That's why it allows Service Principal. On your example, you are working with direct query to a semantic model source. That's totally different. Like I said, sources won't work the same way. You can create a shared connection to a semantic model with AAS connector probably but it will use Entra ID credentials. You could create a service account for that instead of a service principal as an alternative.
I hope that helps