Table of Contents
- The Deployment Challenge for Data Engineers
- Fabric Deployment Pipelines — Dev to Test to Prod
- What Happens During Promotion — Item by Item
- Deployment Rules — Swapping Environment-Specific Values
- Lakehouse Rebinding — The Critical Question
- Semantic Model Rebinding After Promotion
- What Does NOT Transfer During Promotion
- Will Reports Work Without Attaching the Target Lakehouse?
- Variable Libraries — The Modern Approach
- Sharing Reports — Every Method Explained
- Power BI Apps — The Recommended Sharing Method
- Row-Level Security — Controlling Who Sees What
- Workspace Roles — Admin, Member, Contributor, Viewer
- The Complete Deployment Workflow
- Common Mistakes
- Interview Questions
- Wrapping Up
This is the final post in the Power BI series. We covered architecture, visualizations, DAX, data modeling, and legacy vs Fabric. Now the question every data engineer asks: after I build the semantic model and reports in dev, how do I get them to production? Do the reports actually work after promotion? What happens to the Lakehouse connection? How do I share reports with 500 users securely?
Analogy — Publishing a book. Development is writing the manuscript (building reports in the dev workspace). Deployment is the publishing process: the editor reviews it (test stage), the printer produces it (prod stage), and the distributor ships it to bookstores (sharing). But the book references page numbers and images (Lakehouse connections). If the printer uses different paper sizes (different Lakehouses), the page numbers do not match unless you have a binding guide (deployment rules) that adjusts references automatically. This post is the complete publishing and distribution guide.
The Deployment Challenge for Data Engineers
The question that keeps data engineers up at night:
"I built a report in dev connected to the dev Lakehouse.
When I promote to prod, does it automatically connect to the prod Lakehouse?
Or does the prod report still point to dev data?"
The answer: IT DEPENDS on how you set it up.
Without deployment rules:
Report promotes to prod → still points to dev Lakehouse → WRONG DATA
This is the #1 deployment mistake in Fabric
With deployment rules:
Report promotes to prod → rules swap dev Lakehouse for prod Lakehouse → CORRECT DATA
This is the correct approach
With Variable Libraries (2026):
Report uses variable references instead of hard-coded Lakehouse IDs
Variables resolve per workspace → always correct → no rules needed
This is the futureFabric Deployment Pipelines — Dev to Test to Prod
Deployment Pipelines are Fabric’s built-in promotion mechanism. Three stages, each linked to a workspace.
Setting up deployment pipelines:
1. Fabric portal → Deployment Pipelines (left nav) → Create Pipeline
2. Name: "DataPlatform-Pipeline"
3. Assign workspaces:
Development stage → "DataPlatform-Dev" workspace
Test stage → "DataPlatform-Test" workspace
Production stage → "DataPlatform-Prod" workspace
4. Click the arrow (→) between stages to deploy
What you see in the pipeline view:
[Dev] ──→ [Test] ──→ [Prod]
│ │ │
15 items 15 items 15 items
Compare → Deploy → Compare → Deploy
Each stage shows:
Items in the workspace
Comparison status (new, changed, unchanged, deleted)
Deploy button (promotes selected or all items)What Happens During Promotion — Item by Item
When you click Deploy from Dev → Test:
Semantic Models:
✓ Table definitions (schema) → COPIED
✓ Relationships → COPIED
✓ DAX measures and calculated columns → COPIED
✓ RLS roles and rules → COPIED
✗ Data (Import cache) → NOT copied (test model refreshes independently)
✗ Refresh schedule → NOT copied (configure in test workspace)
✗ Data source connection → STAYS as dev UNLESS deployment rules change it
Reports:
✓ All pages, visuals, slicers, bookmarks → COPIED
✓ Report-level filters → COPIED
✓ Binding to semantic model → REBINDS to the test copy of the semantic model
✗ Personal bookmarks → NOT copied
✗ Subscriptions → NOT copied
Lakehouses:
✓ Lakehouse definition (name, schema) → COPIED
✗ Data (Delta tables, files) → NOT copied
✗ Shortcuts → NOT copied (must be recreated in target)
The test Lakehouse is EMPTY after first deployment
You must run your data pipeline in test to populate it
Notebooks:
✓ Code and configuration → COPIED
✗ Lakehouse attachment → must be rebound (auto-binding or manual)
✗ Output cells → NOT copied
Pipelines (Data Factory):
✓ Pipeline definition → COPIED
✗ Connection references → must be updated via rules or Variable Libraries
Key insight: DEFINITIONS are copied, DATA is not.
Each environment maintains its own data independently.Deployment Rules — Swapping Environment-Specific Values
Deployment rules automatically change environment-specific values when promoting between stages.
Setting up deployment rules:
1. Deployment Pipelines → select your pipeline
2. Click the gear icon (⚙) on the Test or Production stage
3. Select an item (e.g., your semantic model)
4. Click "Add Rule"
5. Choose rule type:
Data Source Rules:
Change the data source connection
Dev: connects to "LH_Dev" Lakehouse
Rule: in Test stage, change to "LH_Test"
Rule: in Prod stage, change to "LH_Prod"
Parameter Rules:
Override parameter values per stage
Dev: parameter "Environment" = "dev"
Rule: in Prod, override to "prod"
Connection Rules:
Swap connections between environments
Dev: SQL connection to sql-dev.database.windows.net
Rule: in Prod, change to sql-prod.database.windows.net
Important limitations:
- Direct Lake on OneLake tables: connector does NOT support data source rules for rebinding
(use parameter rules or Variable Libraries instead)
- Direct Lake on SQL endpoint: data source rules work correctly
- Not all item types support all rule types
- Rules are configured PER STAGE (test rules and prod rules are separate)Lakehouse Rebinding — The Critical Question
This is the most asked question about Fabric deployment: “When I promote a semantic model that reads from a dev Lakehouse, does it automatically read from the prod Lakehouse?”
The answer depends on the semantic model type:
IMPORT mode semantic model:
→ Data source rules work
→ Rule swaps the Lakehouse connection
→ Prod model refreshes from prod Lakehouse
→ Works as expected
Direct Lake on SQL endpoint:
→ Data source rules work
→ Rule swaps the SQL endpoint connection
→ Prod model reads from prod Warehouse/Lakehouse SQL endpoint
→ Works as expected
Direct Lake on OneLake tables:
→ Data source rules DO NOT work (as of mid-2026)
→ Must use PARAMETER RULES instead
→ Set up a parameter in the semantic model (e.g., "OneLakeURI")
→ Override the parameter per stage via deployment rules
→ OR use Variable Libraries (recommended for new projects)
→ OR use Tabular Editor / TMDL to edit the expression
→ This is the most common deployment pain point in Fabric
Three approaches for Direct Lake on OneLake:
Approach 1: Parameter Rules (works today)
1. In semantic model, create a parameter: OneLakeURI
2. Set the M expression to reference the parameter
3. In deployment rules, override OneLakeURI per stage
Limitation: cannot live-edit in Power BI Desktop after this change
Approach 2: Variable Libraries (FabCon 2026 -- recommended)
1. Define lakehouse_id in a Variable Library per workspace
2. Notebooks and semantic models reference the variable
3. Variables resolve automatically per workspace
No deployment rules needed
Approach 3: Notebook auto-binding (March 2026)
1. Enable auto-binding in notebook settings
2. Fabric resolves the correct Lakehouse per workspace
3. Works with Git-connected workspaces
Only for notebooks, not semantic modelsSemantic Model Rebinding After Promotion
When a report is promoted, it automatically rebinds to the
promoted copy of the semantic model in the target workspace.
Dev workspace:
Sales Semantic Model (dev copy)
Sales Report → bound to dev copy of Sales Semantic Model
After promotion to Prod workspace:
Sales Semantic Model (prod copy)
Sales Report → automatically rebinds to prod copy of Sales Semantic Model
This rebinding is AUTOMATIC for reports and their semantic models.
You do NOT need to manually rebind reports to models.
BUT: the semantic model itself still needs its DATA SOURCE corrected.
The report rebinds to the right model, but the model must point
to the right data. That is where deployment rules come in.
Summary:
Report → Model rebinding: AUTOMATIC (handled by deployment pipeline)
Model → Data Source rebinding: MANUAL (via deployment rules or Variable Libraries)What Does NOT Transfer During Promotion
Items that do NOT promote and must be configured per environment:
1. DATA
Lakehouse tables and files are NOT copied
Warehouse tables are NOT copied
Each environment has its own data (populated by its own pipelines)
2. REFRESH SCHEDULES
Semantic model refresh schedules are NOT copied
Configure independently in each workspace
(The refresh DEFINITION promotes, but the schedule configuration does not)
3. GATEWAY CONNECTIONS
On-premises gateway bindings are NOT copied
Configure gateway connections per workspace
4. SUBSCRIPTIONS AND ALERTS
Email subscriptions on reports are NOT copied
Must be set up by users in each environment
5. PERSONAL BOOKMARKS
User-created bookmarks are NOT promoted
Only report-defined bookmarks promote
6. SENSITIVITY LABELS
Microsoft Purview labels do NOT transfer via Git or deployment pipelines
Must be applied separately per stage (or use domain-level defaults)
7. SHORTCUTS
Lakehouse shortcuts are NOT copied
Must be recreated in target workspace
8. PERMISSIONS
Workspace-level permissions are NOT affected by deployment
Each workspace maintains its own role assignmentsWill Reports Work Without Attaching the Target Lakehouse?
The critical scenario:
You promote a Direct Lake report from dev to prod.
The prod Lakehouse is EMPTY (no data loaded yet).
What happens?
- The report OPENS but shows BLANK visuals (no data)
- No error -- just empty charts and tables
- The semantic model is structurally valid but has no data to read
You promote a Direct Lake report from dev to prod.
The prod Lakehouse does NOT EXIST yet.
What happens?
- The report FAILS to load
- Error: data source not found
- The semantic model cannot connect to a non-existent Lakehouse
You promote a report but forget deployment rules.
The prod report still points to the DEV Lakehouse.
What happens?
- The report WORKS but shows DEV data in production
- Users see development/test data thinking it is production
- This is the WORST scenario -- wrong data, no errors
Correct deployment order:
1. Create prod Lakehouse (if it does not exist)
2. Run data pipeline to populate prod Lakehouse with production data
3. Deploy semantic model with deployment rules (point to prod Lakehouse)
4. Verify: open prod report → confirm it shows production data
5. Deploy report
6. Share with users
The Lakehouse MUST exist and contain data BEFORE the report is useful.
Deployment pipelines promote definitions, not data.Variable Libraries — The Modern Approach
Variable Libraries (FabCon 2026) are the cleanest solution
for multi-environment deployment.
How they work:
Step 1: Define variables per workspace
Dev workspace Variable Library:
lakehouse_id = "abc-123-dev"
sql_connection = "sql-dev.database.windows.net"
environment = "dev"
Prod workspace Variable Library:
lakehouse_id = "xyz-789-prod"
sql_connection = "sql-prod.database.windows.net"
environment = "prod"
Step 2: Reference variables in code (not hard-coded values)
Notebook: lakehouse_id = variable_library.get("lakehouse_id")
Pipeline: connection = variable_library.get("sql_connection")
Step 3: Deploy without rules
When you promote from dev to prod:
The code is identical
Variables resolve to prod values automatically
No deployment rules needed
No parameter overrides needed
Benefits:
- Code is environment-agnostic (same in dev, test, prod)
- No deployment rules to configure or maintain
- Works with Git integration (variables are workspace-level, not code-level)
- Connection reference variables for database connections
- Reduces deployment errors dramaticallySharing Reports — Every Method Explained
Five ways to share Power BI reports:
1. WORKSPACE ACCESS (simplest, least secure)
Add users to the workspace with Viewer role
They see ALL items in the workspace
Problem: users see Lakehouses, notebooks, and other items too
Use for: internal team access only
2. POWER BI APPS (recommended for business users)
Create an App from the workspace
Select which reports to include
Assign audiences (security groups)
Users install the App and see only published reports
Problem: cannot share individual reports
Use for: department-wide report distribution
3. DIRECT LINK SHARING (quick, per-report)
Open report → Share → Copy link
Send link to specific users or security groups
Can set: view-only or view + reshare
Can include: specific bookmark or filter state
Use for: sharing individual reports with specific people
4. PUBLISH TO WEB (public, no authentication)
Creates a public URL or embed code
ANYONE with the link can view (no sign-in required)
WARNING: data is publicly accessible on the internet
Use ONLY for: public data, marketing dashboards, conference demos
NEVER use for: internal, sensitive, or confidential data
5. EMBED (in custom applications)
Embed Power BI visuals in web applications
Uses Power BI Embedded or Fabric Embedded
Authentication: user owns data (Azure AD) or app owns data (service principal)
Use for: ISV applications, customer-facing portals, internal portalsPower BI Apps — The Recommended Sharing Method
Creating a Power BI App:
1. Open the production workspace
2. Click "Create App" (top right)
3. Configure:
Name: "Sales Analytics"
Description: "Monthly revenue, customer insights, and pipeline metrics"
Contact: data-team@company.com
4. Select content:
Check which reports and dashboards to include
Set navigation order (which report is the landing page)
Hide reports that are work-in-progress
5. Set audiences:
Create audience groups (All Users, Managers, Executives)
Assign security groups to each audience
Different audiences can see different reports
6. Publish the App
Users access the App:
- Left nav in Power BI Service → Apps → "Sales Analytics"
- Direct link: app.powerbi.com/groups/me/apps/{app-id}
- Users see only the reports in the App, not the workspace
- Users cannot edit reports, modify data, or see underlying model
Updating the App:
- Make changes in the workspace (edit reports, refresh models)
- Click "Update App" to push changes to all users
- Users see updated content immediately after update
- No reinstallation neededRow-Level Security — Controlling Who Sees What
RLS filters data based on the user’s identity. The same report shows different data to different users.
Static RLS:
Define fixed roles with hard-coded filters.
Role: "Ontario Sales"
Filter: Orders[Region] = "Ontario"
Role: "Quebec Sales"
Filter: Orders[Region] = "Quebec"
Problem: every new region = new role = model change + republish
Dynamic RLS (recommended):
Define one role with a filter that evaluates the current user.
Step 1: Create a security table in your Lakehouse/model
SecurityMapping:
UserEmail | Region
john@company.com | Ontario
sarah@company.com | Quebec
mike@company.com | Alberta
Step 2: Create a relationship
SecurityMapping[Region] → DimRegion[Region] (single direction)
Step 3: Define a DAX filter
Role: "DynamicFilter"
Table: SecurityMapping
Filter: SecurityMapping[UserEmail] = USERPRINCIPALNAME()
Step 4: Test in Power BI Desktop
Modeling → View As → check "DynamicFilter" role
Enter a test email → verify filtering works
Step 5: Assign users to the role
Power BI Service → workspace → Semantic Model → Security
Add users or security groups to the "DynamicFilter" role
Result:
John sees Ontario data only
Sarah sees Quebec data only
Mike sees Alberta data only
Same report, same measures, different data per user
Dynamic RLS benefits:
- Add new users by adding rows to SecurityMapping table (no model change)
- Change user access by updating the table (no republish)
- Audit who has access by querying the SecurityMapping table
- Manage via your data pipeline (automate from HR system or AD groups)Workspace Roles — Admin, Member, Contributor, Viewer
Four workspace roles:
Admin:
- Full control over the workspace
- Add/remove members, change roles
- Delete the workspace
- Manage deployment pipelines
- Configure Git integration
- Assign: platform team only (2-3 people)
Member:
- Publish content (reports, semantic models)
- Create and edit all items
- Share items and manage permissions
- Configure scheduled refresh
- Assign: data engineers, senior BI developers
Contributor:
- Create and edit items
- Publish reports
- Cannot share items or manage permissions
- Cannot manage workspace settings
- Assign: BI developers, analysts who create reports
Viewer:
- View reports and dashboards
- Cannot edit, create, or delete anything
- Cannot see Lakehouse data directly (need explicit OneLake access)
- Assign: business users (via Apps, not direct workspace access)
Best practice:
Business users should access reports via Power BI APPS, not workspace Viewer role.
Apps provide curated navigation and hide items users do not need.
Workspace Viewer role shows ALL workspace items (including Lakehouses, notebooks).
Direct Lake security note:
Sharing a Direct Lake report grants read permission on the report
but does NOT automatically grant permission to query OneLake Delta tables.
Either grant ReadData on the Lakehouse explicitly
or configure the semantic model to use a fixed identity for OneLake access.The Complete Deployment Workflow
End-to-end deployment for a Fabric Power BI project:
Phase 1: BUILD (Dev workspace)
1. Data engineer builds gold layer tables in dev Lakehouse
2. Data engineer creates semantic model (Direct Lake on dev Lakehouse)
3. Data engineer defines relationships, RLS roles
4. BI developer writes DAX measures
5. BI developer builds report pages with visuals
6. Team reviews via Git PR (if Git integration enabled)
Phase 2: CONFIGURE DEPLOYMENT
7. Create Deployment Pipeline: Dev → Test → Prod
8. Assign workspaces to each stage
9. Configure deployment rules:
- Semantic model: swap data source to test/prod Lakehouse
- Notebooks: enable auto-binding (or set via Variable Libraries)
- Pipelines: update connection references
Phase 3: DEPLOY TO TEST
10. Ensure test Lakehouse exists and has data (run pipeline)
11. Deploy from Dev → Test
12. Verify: open test report → confirm test data appears
13. Configure refresh schedule in test workspace
14. Run validation tests (row counts, measure values)
Phase 4: DEPLOY TO PRODUCTION
15. Ensure prod Lakehouse exists and has production data
16. Deploy from Test → Prod (with approval if configured)
17. Verify: open prod report → confirm production data appears
18. Configure refresh schedule in prod workspace (if Import)
19. Set up RLS: assign users/groups to security roles
Phase 5: SHARE
20. Create Power BI App from prod workspace
21. Select reports to include
22. Set audiences (security groups)
23. Publish the App
24. Communicate to users (email, Teams, SharePoint link)
Phase 6: MAINTAIN
25. Monitor refresh failures (Power BI Service → Settings → Refresh history)
26. Monitor capacity consumption (Capacity Metrics App)
27. Update App when reports change
28. Review RLS assignments periodically
29. Rotate service principal credentials annuallyCommon Mistakes
Promoting without deployment rules and getting dev data in prod. The most dangerous mistake: a production report still connected to the dev Lakehouse shows development data to business users — no errors, just wrong numbers. Always configure deployment rules to swap data sources per stage, and VERIFY by opening the promoted report and checking the data.
Deploying before the target Lakehouse has data. Promoting a Direct Lake model to prod when the prod Lakehouse is empty results in blank reports. Always run your data pipeline to populate the target Lakehouse BEFORE promoting the semantic model and report.
Using workspace access instead of Apps for business users. Adding 200 business users as workspace Viewers gives them access to ALL workspace items — Lakehouses, notebooks, pipelines, semantic models, and reports. Use Power BI Apps instead: they show only the reports you select, with curated navigation and audience targeting.
Not testing RLS before publishing to production. An RLS rule with a typo (USERPRINCIPALNAME vs USERPRINCIPALNAME()) silently fails — users see all data or no data. Always test RLS in Desktop (Modeling → View As) and in Service (workspace → Semantic Model → Security → Test As) before sharing.
Using static RLS instead of dynamic RLS. Static RLS with hard-coded roles (“Ontario Sales,” “Quebec Sales”) requires a model change and republish for every new region or team. Dynamic RLS with a SecurityMapping table and USERPRINCIPALNAME() lets you manage access by updating a table — no model changes needed.
Sharing reports via “Publish to Web” for internal data. Publish to Web creates a public URL with NO authentication. Anyone on the internet can view the data. Never use this for internal, sensitive, or confidential reports. Use Apps or direct sharing with authenticated users instead.
Not understanding that data does not transfer during promotion. Deployment pipelines copy DEFINITIONS (model schema, report layout, DAX), not DATA. Each workspace maintains its own data independently. After promoting a Lakehouse definition to prod, the prod Lakehouse is empty until you run the data pipeline.
Forgetting to grant OneLake access for Direct Lake reports. Sharing a Direct Lake report grants read access to the report but NOT to the underlying Delta tables in OneLake. Users may see “access denied” errors. Either grant ReadData on the Lakehouse explicitly or configure the semantic model to use a fixed identity for OneLake access.
Interview Questions
Q: What are Fabric Deployment Pipelines and how do they work? A: Deployment Pipelines are Fabric’s built-in promotion mechanism with three fixed stages: Development, Test, and Production. Each stage is linked to a workspace. When you deploy from Dev to Test, item definitions (semantic models, reports, notebooks, pipelines) are copied to the test workspace. Deployment rules automatically swap environment-specific values (data source connections, parameters). Data is NOT copied — each workspace maintains its own data. Reports automatically rebind to the promoted copy of the semantic model in the target workspace.
Q: What happens to a Direct Lake semantic model when promoted to production? A: The semantic model definition (tables, relationships, DAX measures, RLS rules) is copied to the production workspace. The model rebinds to the production workspace context. However, the data source connection must be updated to point to the production Lakehouse. For Direct Lake on SQL endpoints, deployment rules handle this automatically. For Direct Lake on OneLake tables, you need parameter rules or Variable Libraries because data source rules do not support OneLake binding changes. The production Lakehouse must exist and contain data before the report is useful.
Q: What is the difference between Static RLS and Dynamic RLS? A: Static RLS uses hard-coded filter expressions in role definitions (Region = “Ontario”). Every new region or access change requires editing the model and republishing. Dynamic RLS uses a security mapping table and USERPRINCIPALNAME() to evaluate the current user’s email against the table at query time. Adding or changing user access only requires updating the mapping table — no model changes needed. Dynamic RLS is strongly recommended for production because it decouples access management from model development.
Q: How should you share Power BI reports with business users? A: Use Power BI Apps. Create an App from the production workspace, select which reports to include, set navigation order, and assign audiences (security groups). Users install the App and see only the published reports in a curated experience. Apps are preferred over workspace access because workspace Viewers can see all workspace items (Lakehouses, notebooks) — Apps show only reports. For individual sharing, use direct link sharing with specific users. Never use Publish to Web for internal or sensitive data.
Q: What does NOT transfer when you promote content between deployment pipeline stages? A: Data does not transfer — each workspace has its own Lakehouse/Warehouse data populated by its own pipelines. Refresh schedules are not copied — configure independently per workspace. Gateway connections are not copied. Email subscriptions and alerts are not copied. Personal bookmarks are not promoted. Sensitivity labels require separate application per stage. Lakehouse shortcuts must be recreated. Workspace permissions are independent. Only definitions (schema, layout, code, DAX) are promoted.
Q: What are Variable Libraries and how do they improve deployment? A: Variable Libraries (announced FabCon 2026) store environment-specific values (Lakehouse IDs, connection strings, parameters) at the workspace level. Code references variables instead of hard-coded values. When items are promoted across stages, variables resolve automatically per workspace — the dev variable points to the dev Lakehouse, the prod variable points to the prod Lakehouse. This eliminates the need for deployment rules and parameter overrides, making code truly environment-agnostic. Connection reference variables also support database connections.
Q: Describe the complete end-to-end deployment workflow for a Fabric Power BI project. A: Build gold layer tables in the dev Lakehouse, create a Direct Lake semantic model with relationships and RLS, build reports. Set up a Deployment Pipeline with deployment rules to swap data sources per stage. Ensure target Lakehouses exist and have data. Deploy Dev → Test, verify test data appears, run validation. Deploy Test → Prod with approval, verify production data. Configure refresh schedules per environment if using Import mode. Create a Power BI App from the prod workspace with selected reports and audience targeting. Share the App with business users via security groups. Monitor refresh failures and capacity consumption ongoing.
Wrapping Up
Deployment in Fabric Power BI has three layers: definitions move (deployment pipelines copy schema, layout, DAX), data stays (each environment has its own Lakehouse with its own data), and connections must be redirected (deployment rules or Variable Libraries swap the data source per environment). Reports automatically rebind to the promoted semantic model, but the semantic model must be explicitly configured to point to the correct Lakehouse in each stage.
For sharing, Power BI Apps are the recommended method for business users — curated, secure, and audience-targeted. RLS (dynamic, not static) controls who sees what data. Workspace roles control who can edit and manage content. And the complete workflow — build, configure rules, deploy, verify, share, monitor — is the production process that data engineers own.
This completes the Power BI series. From architecture to deployment, you now have the full picture of how data engineers build, model, deploy, and share Power BI content in the Fabric era.
Related posts: – Legacy vs Fabric Power BI – Data Modeling for Power BI – Fabric Git Integration & Deployment Pipelines – CI/CD for ADF & Fabric – Fabric Security & Governance