What it does

Lets a report use image and shape-map files stored in Microsoft OneLake instead of anonymously hosted URLs. Power BI loads each file using the report viewer's own Microsoft Entra identity, so the files stay authenticated — no public access required, but every viewer needs read permission on them.

Key facts

• Files live in the Files area of a Fabric lakehouse; you upload through the lakehouse explorer or OneLake file explorer, then copy each file's URL from its Properties pane.
• URLs use the OneLake HTTPS format: https://onelake.dfs.fabric.microsoft.com/<workspace-guid>/<item-guid>/Files/<path>/<file-name>.
• Two ways to consume: paste a single URL into a visual's Format pane (image or card visuals) for a fixed image, or drive image selection from data.
• Requires a Fabric workspace where you can create a lakehouse, plus Power BI Desktop or edit permission on a report in the service.
• Granting viewer access needs a workspace Admin or Member role, or help from someone who has one.

When to use / skip

Use it when report images must be secured — logos, product shots or shape maps that shouldn't sit on an anonymous endpoint. Skip it for genuinely public imagery where a plain hosted URL is simpler and carries no per-viewer permission overhead.

Configuration decisions

• Whether images are secured (OneLake) or public (hosted URL) — this drives the whole permission model.
• How viewers get read access to the lakehouse files, and who administers that access.
• Single fixed image versus data-driven image selection, which changes how you wire the URL into the visual.

Gotchas

• Every viewer needs read permission on the OneLake files; miss that and the images silently fail to load for exactly the people you shared the report with, while they render fine for you.
• The permission is separate from report sharing — sharing the report doesn't grant access to the underlying lakehouse files.

Consultant notes

• This quietly ties a report's images to a Fabric workspace and its access model. Before you adopt it, confirm the audience already has, or can be given, lakehouse read access — otherwise you've swapped a broken-link problem for a blank-image-for-half-the-org problem.
• It only helps where the requirement is genuinely "these images must be authenticated". Teams reach for it as a tidy asset store and then carry Fabric capacity and permission overhead for images that could have been public.
• Because the file URL embeds workspace and item GUIDs, moving or recreating the lakehouse breaks every reference. Treat the URLs as environment-specific and factor them into your ALM/deployment story rather than hard-coding them across reports.

---

Revisit after the next Fabric/Power BI wave