Unexpected Behavior in Linked Dataflows — Bypassing Workspace Access Restrictions

Hi Microsoft Fabric Team,

I’ve encountered an unexpected behavior in Power BI/Fabric related to linked dataflows across workspaces, and I wanted to raise it for awareness and clarification.

Scenario:

• I have a dataflow in Workspace A that I want to reference in Workspace B.
• Workspace B is accessible to a colleague who should not have access to Workspace A.
• Normally, linking a dataflow entity from Workspace A into Workspace B requires the user to have access to Workspace A — which aligns with the documented behavior.

What I Discovered:

If I disable load on the linked entity (so it appears italicized), and then reference it in a new query within the same dataflow, the usual access restrictions disappear:

• The new query can be loaded and used without requiring access to Workspace A.
• No additional transformations are needed — even a simple reference like = EntityName works.
• This effectively bypasses the linked entity access control, allowing users to use data they technically shouldn’t be able to access.

Why This Is Concerning:

• It undermines the security model around linked dataflows.
• It’s not documented, and feels like an unintended loophole.
• It could lead to inconsistent governance in enterprise environments where workspace boundaries are critical.

Why It’s Useful:

Ironically, this behavior allowed me to achieve exactly what I needed — sharing a specific dataflow across workspaces without exposing the entire source workspace. But it feels like a workaround that shouldn’t work, and I’m concerned it might break in future updates or introduce risks.

Could you clarify whether this is:

• An intended feature?
• An unintended loophole?
• Something that will be addressed or changed in future releases?

Kind Regards,

David

(and I totally used Copilot to write this message)