Idea (Description)

Summary

Today, the service account or Service Principal (application user) that backs a Dataverse Shortcut into Microsoft Fabric must hold the System Administrator role in Dataverse to access data in the Dataverse Managed Lake. There is currently no supported least-privilege alternative. This idea requests a supported, documented custom security role (or a scoped set of privileges) that grants only the access needed for Fabric to read Dataverse data - without full environment admin rights.

Problem / Impact

• The Dataverse Managed Lake does not appear to honor the standard Dataverse table-level security model. A custom read-only role scoped to specific tables is not sufficient, and attempts to build one up produce privilege errors (for example, a missing prvReaddatalakefolder privilege on the datalakefolder entity).
• Because the only reliable resolution is granting System Administrator, the integration account ends up with full read/write/delete authority over the entire environment.
• This directly conflicts with the Principle of Least Privilege in the Azure Well-Architected Framework security guidance.
• For organizations in regulated and government environments, security teams are unwilling to place a System Administrator–level app user in production/higher environments. If such an account were compromised, the blast radius includes deletion or modification of production data - even though the Fabric integration itself is read-only. This is a genuine adoption blocker.

Why "read-only shortcuts" isn't a sufficient answer

The documentation notes that Dataverse Shortcuts are read-only regardless of the account's permissions. While that limits what Fabric can do through the shortcut, it does not reduce risk: the underlying service account still holds System Administrator across the whole environment and can be abused through other vectors if compromised.

Documentation inconsistency to resolve

• Create a Dataverse shortcut (Microsoft Fabric) states the account must have System Administrator to access the Managed Lake.
• Configure your environment and link to Microsoft Fabric (Power Apps) says the workspace identity should be "granted the appropriate role (commonly System Administrator)," which implies it is not strictly mandatory.

These two statements read as contradictory. Whatever the outcome, the documentation should be updated to state clearly and consistently whether System Administrator is mandatory.

Requested outcome (any one of the following would resolve this)

1. Publish a supported least-privilege custom security role for Fabric Shortcuts / Link to Fabric, with the exact list of core privileges required (e.g., the necessary datalakefolder read privileges plus table-level Read on the tables being surfaced).
2. Make the Managed Lake honor the standard Dataverse table-level security model, so a scoped read-only role works reliably.
3. If System Administrator will remain a hard requirement by design, update the documentation to state this explicitly and consistently across all articles, and provide guidance for regulated/government customers on how to reduce risk (e.g., a dedicated, tightly governed integration principal).

Business value

Removing the mandatory System Administrator requirement or clearly documenting a minimal privilege set - would unblock Fabric adoption for security-conscious, compliance-bound organizations and align the Dataverse-to-Fabric integration with Microsoft's own least-privilege security principles.