Forum Discussion

Kuladeep's avatar
Kuladeep
Icon for Advocate II rankAdvocate II
4 months ago
Solved

User with VIEWER role cannot see reports connected to Direct lake semantic model

Dear Fabric community,   We are facing an issue that users with `Viewer` role in Workspace unable to see any visuals from reports connected to Direct lake Semantic Models (SM). But `Contributor` ab...
Need Help
  • Kuladeep's avatar
    Kuladeep
    2 months ago

    Microsoft's suggested solution is to use 'App-Owned Data' rather than 'User-Owned Data'. This method eliminates the need for users to have access to the lakehouse in DirectLake mode, as a service principal provides access between the lakehouse (LH) and semantic model.

     

    The disadvantage is that this solution only works with web apps (as it is a Power BI embedded report; app-own-data). If the user tries to access the same report from the Fabric portal, they will encounter the same issue. 

v-sgandrathi's avatar
v-sgandrathi
Icon for Community Support rankCommunity Support
3 months ago

Hi Kuladeep,

 

Hi @Kuladeep,

Thank you for sharing the update from Microsoft Support.

According to their response, this behavior is expected for Direct Lake semantic models—users need at least Contributor-level permissions to access report data, which matches your findings that only Contributors and above can view reports, while Viewers get errors.

About the additional issues after testing the Data Access Roles API, please note that since the API is in Preview and the role was created with dataAccessRoleConflictPolicy=Overwrite, this might have replaced existing roles instead of adding to them. Since the errors began after this change, it’s a good idea to check with Microsoft Support if the custom Data Access Role setup is causing these issues and if they recommend any cleanup or rollback steps.

For large-scale workspace provisioning, the supported method is still to use Microsoft Entra ID security groups with Fabric and Power BI permission APIs, rather than the Preview Data Access Roles API.

The following documentation may be helpful for more details:

  • Direct Lake overview
  • Data security overview in Microsoft Fabric
  • Lakehouse sharing and permission management
  • Semantic model permissions
  • OneLake data access roles APIs announcement (Preview)

Could you share any guidance from Microsoft Support on how to revert or remove custom Data Access Roles? This could help clarify if the semantic model errors are related to recent security changes.


I would suggest:

Security in Microsoft Fabric - Microsoft Fabric | Microsoft Learn
Direct Lake overview - Microsoft Fabric | Microsoft Learn

 

Thank you.