When enabling Microsoft Entra ID single sign-on (SSo) for Starburst (Preview) report viewers querying semantic models in DirectQuery mode authenticate to Starburst with their own Entra ID identity, to Starburst's access policies — including row-level and column-level security rules — are evaluated against the actual end user rather than a fixed connection account. Two connectors, one to use The Starburst connectors are built and maintained by Starburst. Two Starburst entries appear in the Power BI Get Data list. The original Starburst connector remains available for existing reports, but the new SSO experience ships in the Starburst secured by Entra ID connector — pick this one for any new report where you want Entra identities to flow end-to-end, as in the following screenshot. Figure: The Starburst secured by Entra ID connector. How it works The Starburst secured by Entra ID connector supports both Import and DirectQuery semantic models through the on-premises d...
Workspace outbound access protection (OAP) is a workspace-level control in Microsoft Fabric that lets you constrain where the data inside a workspace can flow. With this preview, OAP support now extends to Power BI reports. The good news for report authors and admins: there's nothing new to configure on the report itself. Protection comes from a single, well-defined rule that the workspace enforces automatically as soon as you turn OAP on. Why it matters Power BI reports don't carry their own data connections. They're bound directly to a semantic model. That binding isn’t always obvious when you’re reasoning about data boundaries — a report sitting in a sensitive workspace might bind to a semantic model in another workspace. Such a report mostly retrieves data from its semantic model (an inbound flow), but filter values, such as those specified using query string parameters in the report URL, would flow outbound across the data boundary. Before OAP, a workspace admin had ...