I love organising. When it comes to Microsoft Fabric, I am no different. The addition of files was a heaven-sent for me as I could finally clear up the clutter and make a Fabric solution user friendly to navigate. This allows my end users to access the correct information when they need it, quickly and accurately.

Majority of the time, the end user does not need to access the Data Warehouse or Lakehouse that is storing their data, but rather the reporting layer we build upon that. Fabric has given us the ability to have all our layers of data transformation on one platform, so it is important to section this out properly so that the correct level of data security is maintained.

Imagine this architecture:

Two different workspaces within the same tenant – one for our data engineering where the primary data store is kept, and a reporting workspace that feeds off the storage. In my storage workspace, I have a Data Warehouse with my cleaned and transformed data in it. To make the most of the Fabric capabilities, I then created a Lakehouse with shortcuts to my Warehouse tables, to create a semantic model that is in Direct Lake mode to be used for reporting.

For my reporting layer, we have a dedicated workspace where we can create reports and dashboards. A user within this reporting workspace may have read or write permissions for the workspace, and read permission on the Data Lakehouse and Semantic model. This means that the original data source stays as the single source of truth, but gives end users the autonomy to build reports based on that data.

To enable you to access the semantic model from your storage workspace, you must:

  • Go into the admin portal for your tenant
  • Enable the ‘Use Semantic models across workspaces’ setting

  • If you are still having access issues for users who have permissions to use reports, and have read-only access to the data source in the storage workspace, it may be necessary to add an additional setting
    • Go into the semantic model settings, and in Gateway and cloud connections, set up a Cloud connection
    • Create a new Single Sign-On Cloud Connection where server is your SQL Connection String for the Workspace where the Lakehouse is and server is the Lakehouse name
    • Authentication method should be OAuth 2.0, and sign in with an account that has read/write permissions on the Lakehouse

I hope this guide can help you to split out your workspaces in Fabric, and still access the data that is needed for reporting!

Tags: , , ,

« Previous Post
Next Post »