Enable the required tenant settings

A few Fabric Admin portal → Tenant settings control the data access Icon Map needs. A Fabric administrator enables them once. You can scope most of them to a security group if you'd rather not enable them tenant-wide.

For everyday use inside Fabric

These support building and reading maps in the workload:

  • Users can create Fabric items — so people can create Icon Map items (usually already on).
  • Use short-lived user-delegated SAS tokens (OneLake settings) — allows users to request the OneLake user-delegation keys that the next setting depends on.
  • Authenticate with OneLake user-delegated SAS tokens (OneLake settings) — Icon Map reads OneLake files (tiles, imagery, catalog styles) in the browser using short-lived SAS tokens issued for the signed-in user. If this is disabled, those reads fail with a 401 even though everything else works. Microsoft delegates this setting to workspace admins by default, so it can also be enabled workspace by workspace.
  • Semantic Model Execute Queries REST API (previously "Dataset Execute Queries REST API") — required for Power BI semantic model sources. Users also need Build permission on the model they connect to.

For publishing and embedding maps outside Fabric

If you'll publish maps for viewing in your own sites and apps, also enable:

  • Service principals can call Fabric public APIs (Developer settings) — the published-map reader identity is a service principal. You can scope this to a security group containing that service principal (see Set up publishing).
  • Users can access data stored in OneLake with apps external to Fabric (OneLake settings) — the embedded viewer reads OneLake through the Azure Data Lake API from outside Fabric, so this must be enabled.

For live-data published maps

If a published map serves live data (rather than a snapshot), and it uses Power BI semantic models, also enable:

  • Service principals can use Power BI APIs (Developer settings).

After enabling

Tenant-setting changes can take 10–30 minutes to take effect. If a published map shows "map isn't available" or a 403 shortly after setup, the setting or a workspace grant likely hasn't propagated yet.

Next steps