Forum Discussion
Advocate IIUser with VIEWER role cannot see reports connected to Direct lake semantic model
Microsoft's suggested solution is to use 'App-Owned Data' rather than 'User-Owned Data'. This method eliminates the need for users to have access to the lakehouse in DirectLake mode, as a service principal provides access between the lakehouse (LH) and semantic model.
The disadvantage is that this solution only works with web apps (as it is a Power BI embedded report; app-own-data). If the user tries to access the same report from the Fabric portal, they will encounter the same issue.
Advocate IIReply from microsoft:
- Alternative approach for Viewer role access to Direct Lake reports
As confirmed before by my colleague, in order for users to view report built on a direct lake semantic model they will need to be at least Contributors in order to be able to see the data
Please refer to: Data security overview - Microsoft Fabric | Microsoft Learn
- APIs or automation for managing Lakehouse permissions
The OneLake team provides APIs to manage data access roles.
These APIs can be used to programmatically manage granular data access for your lakehouses. They allow you to create Data access Roles and assign members to the roles. However, is important to highlight that this API is part of a Preview release and is provided for evaluation and development purposes only. It may change based on feedback and is not recommended for production use. In the following blog you’ll find the step by step on how to use this approach: OneLake data access roles APIs announcement - Microsoft Fabric Community
- Best practices for enterprise-scale workspace provisioning
To provide the most appropriate recommendations for your specific scenario, we suggest engaging in a more hands-on review of your environment. While Microsoft Support focuses on break-fix issues, design and consultation guidance falls outside of our scope.
We recommend reaching out to your Account Manager to check if a can assist you with tailored guidance. Additionally, I will reach out internally to your account team to raise awareness of this need.