Controlled "Semantic Model Execute Queries" REST API Access for Fabric Users
We want to enable the executeQueries endpoint for a large audience of users so that an application can execute DAX queries against a directlake model (with SSO enabled) on their behalf. Enabling this endpoint poses a security risk because it allows users to access Fabric via unapproved tools. (Some are safe and helpful, but this can't be guaranteed.) The relevant tenant setting ("Semantic Model Execute Queries REST API") can be scoped to security groups, but it cannot limit incoming traffic to a specific source (our trusted application). Fabric provides controls to limit inbound traffic - IP allow-lists, private links at the workspace level, conditional entra access policies, etc. We have reviewed the options on this page: About inbound access protection in Fabric - Microsoft Fabric | Microsoft Learn. Semantic models are not supported for most of these solutions (private links, for example), and even if they were, they seem like they would treat API access and portal access the same. Any setting that sufficiently restricts traffic to the API endpoint would also lock users out of the Fabric portal itself (or unnecessarily restrict data in the portal). Have we missed anything? Is there a way to conditionally allow API access from specific sources for security groups without negatively impacting users by applying those same restrictions to standard portal access?
getting issue with Project osmos
I was recently testing the project osmos with an f2 capacity got this error after it executed for some 40 mins.I was just testing .Gave this prompt and got the error after execution : """ Create a Project Osmos task for the OSMOS_SupplyChain_Lakehouse. Build an end-to-end supplier performance data engineering solution. Create a small sample supplier order dataset containing supplier, material, ordered quantity, delivered quantity, promised delivery date, actual delivery date, defect rate, shipment mode, supplier rating and supplier remarks. Create a bronze layer that preserves the source data. Create a silver layer that: - standardizes data types - handles invalid or missing values - calculates delivery delay days - calculates delivery performance - validates ordered and delivered quantities - standardizes supplier ratings and defect rates Create a gold table named gold_supplier_performance containing: - supplier - total orders - total ordered quantity - total delivered quantity - average delivery delay - average defect rate - delivery performance - supplier rating - supplier risk category Create Spark notebooks required to implement the solution. Run the transformations in the correct order. Validate: - row counts - null values - duplicate supplier/order keys - data types - delivery calculations - quantity totals - gold table output Do not modify or delete existing user data. Use new tables and artifacts for this demonstration. """ I want to understand that what alternative we can have to use it on a f2 capacity or we need to upgrade to a bigger capacity. ERROR={"code":"CapacityLimitExceeded","subCode":0,"message":"Unable to complete the action because your organization�s Fabric compute capacity has exceeded its limits. Try again later.","timeStamp":"2026-10-09T10:40:07.882692Z","httpStatusCode":429,"hresult":-2147467259,"details":[{"code":"RootActivityId","message":"282fd3a5-6245-426e-b5cd-df7656b0025f"}],"exceptionCategory":1} Failed with exit code 1
Fabric capacity metrics vs activity logs for cost attribution
I have been working on the backend of a packaged Fabric Spend Analyzer, and the difficult part has been reconciling usage rather than building the dashboard. Capacity metrics, activity data, and workload-level signals can behave differently around spikes, background operations, and delayed telemetry. We added pipeline checks for missing or late data before it reaches the spend model, and tightened the DAX calculations around those cases. A few “correct-looking” numbers turned out to be wrong once we traced them back to the underlying usage data. For those building Fabric capacity reporting, how are you validating cost attribution when the underlying telemetry is incomplete or arrives at different times?
Cross-Tenant VNet Peering with VNet Data Gateway
I am considering the following architecture: Microsoft Fabric → VNet Data Gateway → Tenant A VNet → Cross-Tenant VNet Peering → Tenant B VNet → Private Endpoint → Azure Database for PostgreSQL Flexible Server The VNet Data Gateway is deployed in the same tenant as Microsoft Fabric (Tenant A). PostgreSQL Flexible Server and its Private Endpoint are in Tenant B. Is this architecture supported by Microsoft Fabric? I am especially interested in: Private DNS configuration across the two VNets Cross-tenant VNet peering configuration VNet Data Gateway configuration PostgreSQL Private Endpoint configuration Has anyone implemented this architecture in a PoC or production environment? If so, I would appreciate any configuration examples or screenshots from Azure Portal or Fabric Portal.Is VNet Data Gateway → Cross-Tenant VNet Peering → PostgreSQL Private Endpoint supported?
Is VNet Data Gateway → Cross-Tenant VNet Peering → PostgreSQL Private Endpoint supported in Microsoft Fabric? I am designing an architecture where Microsoft Fabric connects to an Azure Database for PostgreSQL Flexible Server located in a different Microsoft Entra ID tenant, without using any public network connectivity. The proposed architecture is : The VNet Data Gateway will be created in Tenant A, which is the same tenant as Microsoft Fabric. The PostgreSQL Flexible Server is located in Tenant B. Public access will be disabled, and the server should only be accessible through a Private Endpoint. We plan to configure cross-tenant VNet peering between VNet A in Tenant A and VNet B in Tenant B. We also plan to configure Private DNS so that the PostgreSQL FQDN can be correctly resolved to the private IP address of the Private Endpoint from the VNet Data Gateway side. I would like to confirm the following: Is it supported for a VNet Data Gateway to connect to a Private Endpoint located in a VNet belonging to another Microsoft Entra ID tenant through cross-tenant VNet peering? Is this architecture also supported when the resource behind the Private Endpoint is Azure Database for PostgreSQL Flexible Server? Has anyone implemented this architecture in a PoC or production environment? If you have implemented a similar architecture, I would greatly appreciate details about the actual configuration, particularly: VNet Data Gateway subnet configuration Cross-tenant VNet peering configuration PostgreSQL Private Endpoint configuration Private DNS Zone and VNet Link configuration DNS resolution from Tenant A to the PostgreSQL Private Endpoint in Tenant B NSG and routing configuration Azure RBAC permissions required in each tenant Fabric Connection / Gateway configuration PostgreSQL connector configuration If possible, I would also appreciate screenshots or examples of the actual Azure Portal and Microsoft Fabric Portal configuration, as well as ARM/Bicep/Terraform/CLI configuration examples. Are there any cross-tenant-specific limitations or considerations that would not normally apply to VNet peering within the same tenant? I found the following related discussion in the Microsoft Fabric Community: “3 Azure Databricks instances in 3 tenants - 1 VNET Data Gateway to connect from Power BI Service” In that discussion, an architecture is proposed where the VNet Data Gateway is deployed in the same tenant as Power BI Service, and it connects through cross-tenant VNet peering to Private Endpoints for Azure Databricks located in other tenants. I also found another implementation example using the following architecture: Power BI → VNet Data Gateway → VNet Peering → Azure Database for PostgreSQL Flexible Server What I would like to validate is essentially a combination of these two scenarios: Microsoft Fabric → VNet Data Gateway → Tenant A VNet → Cross-Tenant VNet Peering → Tenant B VNet → Private Endpoint → Azure Database for PostgreSQL Flexible Server I am particularly interested not only in whether this is technically possible or supported, but also in real-world implementation experience and configuration-level details. In particular, I would like to understand how Private DNS was configured across the tenant boundary and how DNS resolution and routing were implemented from the VNet Data Gateway subnet in Tenant A to the PostgreSQL Private Endpoint in Tenant B. If anyone has implemented this architecture, I would greatly appreciate screenshots, step-by-step configuration details, lessons learned, or any issues encountered during implementation. Microsoft documentation, reference architectures, technical blogs, GitHub examples, and PoC or production implementation examples would also be very helpful.
Fabric Warehouse Git commit fails with “Maximum commit size exceeded” potentially due to XMLA.json
Based on the Fabric Warehouse Git integration documentation, the XMLA.json file should be excluded from Git integration workflows. Fabric should exclude this file from commits and updates to prevent the default semantic model metadata from being unintentionally stored in Git. [learn.microsoft.com] However, it appears that XMLA.json, or the associated semantic model metadata, may still be getting processed on the Fabric side while calculating or preparing the commit. This potentially causes the commit to exceed the maximum allowed size. Any One Face Same Issue, how to avoid above issue & prevent XMLA.json file from getting processes while git commit ?Can't create DataFlowGen2 (Policy Allows)
Hi, we've got a perfect scenario for the new Policy item where we need a user to be able to develop and migrate his personal Dataflow Gen1 to Dataflow Gen2, and we need to enable him to do so. So we've enabled him to Fabric, defined a specific security group for the policy which we've configured in this way: We've tried with him and he isn't able to create other items like notebooks (good), but it fails with a generic error when he tries to create a DataFlow Gen2: He's even Administrator in some workspace, so it's not a problem of the workspace role. There are no additional messages. Any help will be appreciated Daniele Tiles
Fabric Capacity Permissions
So we have decided to move to Fabric F2 at my workplace but we're having issues with permissions. Me and my colleague cannot create workspaces and put it at Fabric Capacity, even though my boss has granted us Capacity Permissions. Our boss who is Capacity Admin can create those workspaces and make us Admin for those workspaces, but in those workspaces we cannot create SQL Databases or Warehouses. We had the same issue when were on the Trial-period. We cannot for the life of us figure out what to do. We want to be able to create Workspaces at Fabric Capacity and create all necessary artifacts such as SQL Databases and Warehouses.
