Forum Discussion
Setting up a shareable cloud connection to a semantic model
Shared source will let developers to build new semantic models, publish and keep a single standard configuration for the refreshes. That only works for refresh data and nothing else. Then you still need to make sure the user that has access to a report also can read the semantic model. I don't think you can get rid of that. Maybe there is a trick for import but for direct query sounds almost impossible.
If you would really really want to separate that. Forget for ever of the semantic model permission for users. I guess the best alternative is embedding in ISV. Embedded software will configure all that for a single service principal and become owners of the distribution and login. They keep who can se what report (assign people manually to report) and forget about models. An example would be https://www.pibi.cloud
I hope that make sense
The example is indeed for a situation where you have everything in the same workspace, but the basics should work across workspaces as well.
But like you said before; it all comes down to the connector used.
I guess the documentation on authenticating with a workspace identity also threw me off a bit, since it says it can also be used on Power BI Semantic Models. Looking more closely: probably only for import mode.
Using a service account is a good option, to replace my personal login within the connection. That is in the connection from the model in workspace B to the one in Workspace A.
But that would still require me to add each user group individually to the model in workspace A right?
Or should SSO be turned off? Tried that before but that gave me an error: “An error occurred in Power BI Premium backend services. Please see the error details for additional information.”
Super UserShared source will let developers to build new semantic models, publish and keep a single standard configuration for the refreshes. That only works for refresh data and nothing else. Then you still need to make sure the user that has access to a report also can read the semantic model. I don't think you can get rid of that. Maybe there is a trick for import but for direct query sounds almost impossible.
If you would really really want to separate that. Forget for ever of the semantic model permission for users. I guess the best alternative is embedding in ISV. Embedded software will configure all that for a single service principal and become owners of the distribution and login. They keep who can se what report (assign people manually to report) and forget about models. An example would be https://www.pibi.cloud
I hope that make sense
I guess looking for other solutions, like within a Fabric environment and Direct Lake mode, would be our best approach. With our current P1 license, it's just a matter of turning on Fabric, which is something we're looking into right now.
Thanks for the help!