Dataverse SQL (TDS) endpoint

Altus reads aggregated data through the Dataverse SQL endpoint, also called the Tabular Data Stream (TDS) endpoint. The project task board and Optimisation plans depend on it, and Power BI report customisation uses it too (see Internet Access for Report Customisation).

These reads run as the signed-in user. Dataverse security roles, record ownership and field security apply exactly as they do in the app: a user only sees the records and fields they can already see.

Settings

The endpoint has two settings, in the Power Platform admin center under Manage > Environments > your environment > Settings > Product > Features > TDS endpoint:

Setting	Default	What Altus needs
Enable TDS endpoint	On	Must stay On. When it's off, every user loses the features above
Enable user level access control for TDS endpoint	Off	Either value works. When it's on, only users with the Allow user to access TDS endpoint privilege can use the endpoint (see below)

Altus security roles include the privilege. Every Altus security role includes Allow user to access TDS endpoint (prvAllowTDSAccess), so users with Altus roles keep working when user-level access control is on.

If you turn on user-level access control

• Altus users keep SQL access. Because Altus roles include the privilege, users with Altus roles can still read, through SQL tools such as Power BI or SQL Server Management Studio, the data they can already see in the app. The control still restricts users who don't have an Altus role.
• Copies of Altus roles don't get the privilege. If your users rely on a role you copied from an Altus role, add Allow user to access TDS endpoint (Miscellaneous privileges, Organization) to that copy. The copy must also be in the Altus app's list of permitted roles, or users who rely on it can't open the Altus app at all (see Granting a custom role access to open the Altus app).

Troubleshooting

Warning

Turning off the TDS endpoint, or turning on user-level access control for users without the privilege, breaks parts of Altus. The project task board stays empty, and Optimisation plans show no initiatives and $0 totals. Check these settings first if a user reports either symptom.

These are the messages behind the symptoms above, shown in Optimisation or in the browser's developer console:

Message	Cause	Fix
TDS protocol endpoint is disabled for this organization.	Enable TDS endpoint is off	Turn it on
Attempted to perform an unauthorized operation. User … is missing prvAllowTDSAccess privilege.	User-level access control is on, and none of the user's roles include the privilege	Give the user an Altus role, or add the privilege to the user's own role

Changes to these settings and to roles take effect immediately; users don't need to sign out.

For more information, see Microsoft's Use SQL to query data and Manage TDS settings.