TDS endpoint and workspace viewer role

[fabricator1]

Hi, 

Can a user with Viewer role in the workspace, use Power BI Desktop or SSMS to connect and read data from a Lakehouse SQL Analytics Endpoint?

I thought Power BI Desktop and SSMS are using the TDS endpoint, and thus a Viewer would only be able to read Lakehouse data through the TDS endpoint if granted permission by a contributor, member or admin (ref. the table below).

However, I am testing with a user who has Viewer role and this user is able to read data from the Lakehouse SQL Analytics Endpoint in Power BI Desktop by using the connection string. (We haven't given this user any granular permissions.)

Is the SQL Analytics Endpoint connection string the same thing as the Lakehouse TDS endpoint, or are they different?

When looking at the actual permissions on my Lakehouse SQL Analytics Endpoint, I can see that Workspace Viewer automatically gets Read and ReadData permissions.

Curious to learn more about this 🙂 Thanks!

Roles in workspaces in Microsoft Fabric - Microsoft Fabric | Microsoft Learn

[v-cboorla-msft]

Hi @fabricator1 

Thanks for using Fabric Community. 
At this time, we are reaching out to the internal team to get some help on this.

We will update you once we hear back from them.

Thanks

[v-cboorla-msft · Accepted solution]

Hi @fabricator1 

That is correct - a user who is just assigned a viewer role can read data in SQL Analytics Endpoint. As per the documentation here (see link), one can connect and also read data for each Warehouse / SQL Endpoint within the workspace. Viewers have SQL permissions to read data from tables/views using T-SQL. So what you are seeing is as per design.
https://learn.microsoft.com/en-us/fabric/data-warehouse/workspace-roles#:~:text=user%C2%A0SQL%20perm...

If the permissions provided by workspace roles are too coarse, one can leverage granular permissions; however, for granular permissions to work, one must either
(a) assign a workspace role (i.e. viewer role); or
(b) assign an item level access.
A Workspace or Item level assignment enables connectivity. Once either (a) or (b) is in place, one can then configure granular permissions to restrict access to specific objects etc. Please refer the documented.
SQL granular permissions - Microsoft Fabric | Microsoft Learn

"Is the SQL Analytics Endpoint connection string the same thing as the Lakehouse TDS endpoint, or are they different?"
In Fabric, we have a Lakehouse SQL analytics endpoint which is accessible via TDS or to put it in other words, the endpoint uses TDS protocol. In Fabric, this is also referred to as a SQL Connection String. This is documented in detail here.
Connectivity to data warehousing - Microsoft Fabric | Microsoft Learn
[MS-TDS]: Overview | Microsoft Learn

I hope this information helps. Please do let us know if you have any further questions. Glad to help.

Thanks.

[v-cboorla-msft]

Hi @fabricator1 

Glad that your query got resolved.

Please continue using Fabric Community for any help regarding your queries.