Case study

Governed reporting across a production network

Industrial manufacturing

An industrial manufacturer whose 25 sites each reported on their own terms. One governed model now serves the network, and every viewer sees only their own numbers.

Read the engagement brief(opens in a new tab)
Period
7 months
Network
25 sites
A schematic: the separate reports this engagement started from, the one consolidated reporting layer that replaced them, and the technologies underneath.

25 site reports, replaced by one network report

Every site could report on itself and none could be compared with another, because the numbers that make a network comparable are also the numbers a site manager should not see for a neighbouring site. One governed model with the access rules inside it solved both.

production sites, reporting on one layer
25
BI consumers, each seeing only their own numbers
800+
domain semantic models: Operations, Controlling, Executive
3
months from the first review to group-wide reporting
7

Anonymised by sector and size, because the confidentiality that protects this client would protect you too. Sector and outcomes are real; identifying detail is not.

Before and after

Before and after the engagement

25 site reports

  • 25 sites, 25 reportsEach on its own terms and in its own layout, largely in Excel
  • No network-level viewNo site could be compared with another
  • Access decided by who had the fileThe reason the obvious fix could never be signed off

One network report

  • One report, a different view for each viewerA site manager sees site 07; group operations see all 25 side by side
  • The access rules sit in the modelCarried by the model rather than by who has the file
  • The assistant answers inside the same rulesAsked about a neighbouring site, it declines: that site is outside the role
Before, every site reported on its own terms and in its own layout. Now one network report reads one governed model, and the same report shows a site manager their own site and group operations all 25 side by side.

The engagement in full

Client
A manufacturer of 1,000 to 5,000 people with 25 production sites, each reporting on its own terms and largely in Excel.
Situation
Site-level reporting existed and network-level reporting did not, and the access question sat on top of it: the numbers that make a network comparable are also the numbers a site manager should not see for a neighbouring site.
Mandate
Introduce Microsoft Fabric from scratch and move the group from site-level reporting to one group-wide reporting platform, without opening each site’s numbers to the others.
What we built
  • FoundationA review of the site-level reporting that showed why no network-level view existed and where the access rules would have to sit.
  • ActivationUnified governed reporting across the network, with enterprise row-level security carrying the access rules, so every stakeholder sees exactly their own numbers and only those.
  • AccelerationAI on the governed network model that answers within the same row-level security, so nobody can ask their way into a neighbouring site’s numbers.

One report, a different view for each viewer

The obvious fix, putting every site in one place, was the thing nobody could sign off. So the access rules sit inside the model rather than around it: the same report shows a site manager their own site, shows group operations all 25 side by side, and the assistant answers within the same rules. Asked how a neighbouring site ran this month, it answers only for the site the viewer’s role covers.

The layer that was missing

Every site keeps its own systems. What was missing was the layer above them: shopfloor, production and ERP data conformed into one site and asset model, read by 3 domain models over Direct Lake. Reports and the assistant read under the same security.

How access is enforced

Roles are driven entirely by Entra security groups, so access changes without anyone touching the model.

  1. Entra security groupMembership is the only thing anyone assigns
  2. OneLake Security roleAround 60 roles, defined once
  3. Model and assistantRead under the viewer’s role
  4. What the viewer seesTheir own sites, and only those

The architecture

Site systems: ERP · MES · OPC UA. OneLake: Bronze · Silver · Gold. Semantic models: Operations · Controlling · Executive. What reads it: Network reporting · AI assistant
Site systems into a medallion lakehouse, conformed into one site and asset model, and read by 3 domain models. Reports and the assistant read under the same security.

Architecture decisions

DecisionRejected alternativeWhy
The access rules sit in the model, not around itA report or a workspace per siteThat multiplies the model by the network and puts the comparison back out of reach.
One model for the network, not one per siteA model per siteA model per site is easy to secure and impossible to compare across, and comparing the sites was the reason the network needed reporting at all.
AI inside the same row-level securityAn assistant with a path of its ownAn assistant on a governed model inherits the model’s security, or it becomes the second way in that the first one was built to prevent.

What the client has today

  • One screen for the group-wide OEE comparison across all 25 sites.
  • Month-end closed on the cockpit rather than from site workbooks.
  • Every viewer sees exactly their own sites, through around 60 roles driven by Entra security groups.
  • A new plant onboarded as standard work rather than as a project.
  • Fabric production capacity sized from measured load rather than from an estimate.
  • AI answering inside the same security the reports run on.
For your IT team

How the network is kept separate without the topology growing with it.

  • Bronze, Silver and Gold across DEV, TEST and PROD. Sites are separated by roles rather than by separate systems, so the topology does not grow with the network.
  • Private Link and managed private endpoints, so data moves on the private network.
  • Customer-managed keys for the data at rest.
  • Purview sensitivity labels, with dynamic data masking on the columns that need it.
Where it left them
One reporting layer for a network that had been reporting in pieces, with the security model doing the work that used to be done by simply not sharing the file.
Stack
  • Microsoft Fabric
  • OneLake
  • OneLake Security
  • Direct Lake
  • Spark
  • MES
  • OPC UA
  • Power BI
  • DAX
  • Azure Key Vault
  • Purview
  • Azure DevOps
All case studies

The other engagements

  • Retail

    Foundation then Activation then Acceleration alongside Stewardship

    Store revenue, executive questions and forecasting on one set of definitions

    A retailer with Microsoft Fabric already in production, semantic models over Direct Lake and store revenue streaming in, who wanted forecasting, Copilot questions and anomaly detection on top of it.

    • Microsoft Fabric
    • Power BI semantic models
    • Direct Lake
    • Copilot in Power BI
    • Fabric AI Functions
    • Activator

  • Hospitality and real estate

    Foundation then Activation

    A CFO cockpit over a group that closed its books separately

    A holding group across hospitality and real estate, with entities that each closed their own books and a CFO who had to answer for all of them.

    • Microsoft Fabric
    • OneLake
    • Direct Lake
    • Databricks Mirrored Catalog
    • Fabric Data Factory
    • Power BI
    • DAX
    • Calculation groups
    • Row-level security
    • Azure DevOps
    • Azure Key Vault
    • Purview

  • Multi-brand retail

    Foundation then Activation

    One governed model across a multi-brand retail group

    A retail group running several brands, each with its own systems, its own reporting habits and its own answer to what a margin is.

    • Microsoft Fabric
    • Direct Lake
    • Databricks
    • Eventstream
    • KQL Database
    • Power BI
    • DAX
    • SAP
    • Salesforce
    • Azure DevOps

  • Omnichannel e-commerce

    Foundation then Activation

    Finance reporting that keeps up with the day

    An omnichannel retailer whose finance leadership was steering on yesterday’s numbers in a business that changes within the day.

    • Microsoft Fabric
    • OneLake
    • Direct Lake
    • Fabric Data Factory
    • Eventstream
    • Power BI
    • DAX
    • REST APIs
    • ERP integration
All case studies

Free consultation

Know where your data stands in an hour.

A free 60-minute consultation. No pitch, no invoice. You’ll leave knowing whether your data is ready for AI, and whether we’re a good fit.

Book your free consultation(opens in a new tab)