Set up publishing and embedding

When you publish a map for viewing outside Fabric, the public embedded viewer reads the frozen, published files back from your OneLake. It does this using an Icon Map reader service principal, which you grant access to each workspace you publish from.

Complete the tenant settings for publishing first, then follow the steps below.

1. Grant the reader service principal access

The reader service principal is named Tekantis.IconMap-Backend (your onboarding contact provides its application ID). In each workspace you publish from:

  1. Open the workspace and choose Manage access.
  2. Add people or groups and search for Tekantis.IconMap-Backend.
  3. Assign the Contributor role (Member or Admin also work).

Do not assign the Viewer role. Viewer does not grant read access to OneLake files through the API, so the embedded map would fail to load with a "Forbidden" error. Allow 10–30 minutes for the grant to take effect.

Granting access is a deliberate, per-workspace step — Icon Map never grants itself access automatically, so publishing always requires an administrator's explicit approval.

2. Additional grants for live-data maps

A snapshot publish needs nothing further. If a published map serves live data, the reader service principal also needs to reach those sources:

  • Eventhouse / KQL — grant the service principal the Viewer role on the specific KQL database (Eventhouse → database → Manage permissions).
  • Power BI semantic models — enable Service principals can use Power BI APIs (in tenant settings); the workspace Contributor grant covers the dataset reads.
  • Lakehouse / Warehouse — no extra grant needed; the OneLake and workspace access above already cover Delta-table reads.

3. Verify

Publish a test map, open the embed link, and confirm it loads. If you see "map isn't available" or a 403, the grant or a tenant setting probably hasn't propagated yet (allow 10–30 minutes); a 404 usually means the published file is missing — re-publish. Published links can be revoked at any time from Publish management.

Next steps