Set up publishing and embedding

When you publish a map for viewing outside Fabric, the public embedded viewer reads the frozen, published files back from your OneLake. It does this using a dedicated Icon Map embed service principal (Tekantis.IconMap-Embed) — a read-only identity with no API permissions of its own.

You do not grant this service principal access to your workspace. Publishing writes your published maps into a Lakehouse in your workspace and grants the embed service principal a read-only OneLake data-access role on just that Lakehouse — automatically, under your own identity, as part of the publish. The result: the embed service can read what you publish and nothing else, with no write access to your workspace.

Complete the tenant settings for publishing first. For most maps there is nothing further to do — publish, and it works.

What happens automatically

The first time you publish in a workspace, Icon Map creates a Lakehouse named IconMap Published to hold published maps, and adds the embed service principal to a read-only data-access role (IconMapEmbedReaders) on it. Every subsequent publish reuses them. This needs no administrator action, provided the publishing user can create items and manage OneLake data access in the workspace (a workspace Member or Admin can).

Large raster tilesets (PMTiles/COG) are not copied — they're read in place from their own Lakehouse so they stay live. Publishing grants the embed service principal read on those source Lakehouses too, the same way.

When someone else has to act

Shared organizational-catalog layers. If your map uses raster layers from an Organizational Catalog whose Lakehouse you don't administer, you can't grant the embed service principal read there. The catalog's owner does it once — grant Tekantis.IconMap-Embed a read-only data-access role on the catalog's Lakehouse — and thereafter every map using that catalog just works. If this hasn't been done, the Publish dialog tells you which layer is affected; the rest of the map still publishes.

Restricted workspaces. If your organization doesn't allow users to create items, an administrator can pre-create the IconMap Published Lakehouse and grant the embed service principal read on it once; authors then publish into it. Either way the grant is read-only, never workspace Contributor.

Additional grants for live-data maps

A snapshot publish needs nothing further. If a published map serves live data, the embed service principal also needs to reach those query sources:

  • Eventhouse / KQL — grant the service principal the Viewer role on the specific KQL database (Eventhouse → database → Manage permissions).
  • Power BI semantic models — enable Service principals can use Power BI APIs (in tenant settings).
  • Lakehouse / Warehouse — no extra grant needed; the read-only data-access role above covers the Delta-table reads.

Verify

Publish a test map, open the embed link, and confirm it loads. If a raster layer is missing, check the Publish dialog for a catalog-embedding warning (above). If the whole map shows "this map needs to be re-published," publish it again from the current editor. Published links can be revoked at any time from Publish management.

Next steps