Best practice for sharing a semantic model across multiple Fabric workspaces without duplicating it

Hi Alaahady​,

The permissions advice above is the right core. One structural change I would add: avoid having production reports depend on models in the DEV workspace. Every edit a developer makes there is instantly live for all four departments. A layout that keeps one copy of each model but separates environments:

DEV  Data       (lakehouse, pipelines, notebooks)        developers only
DEV  Models     (semantic models under development)     developers only
        | deployment pipeline / Git
PROD Data       (lakehouse)                              no business users
PROD Models     (shared, certified semantic models)      no business users
        | Read permission on each model (per department SG)
Sales / Production / Speciality / Leadership workspaces
   thin reports + one app each                           department SG via app audience

Department users then get: app audience in their own workspace + Read on the shared model (no workspace role in PROD Models). If the models are Direct Lake, either use a fixed-identity connection or also grant ReadData on the PROD lakehouse, otherwise reports render with permission errors.

For "only relevant data", a single dynamic RLS role scales better than one role per department:

-- table UserDepartment(UserEmail, Department), maintained from HR / Entra groups
-- RLS filter on the Department dimension:
'Department'[Department]
    IN CALCULATETABLE (
        VALUES ( UserDepartment[Department] ),
        UserDepartment[UserEmail] = USERPRINCIPALNAME ()
    )

Leadership can be handled with a second role whose filter is simply TRUE().

So my overall approach would be:

Separate DEV and PROD for data and models (deploy via pipeline/Git)
-> One shared, certified model per subject in PROD Models
-> Department SG: Read on model + app audience, no PROD workspace role
-> Dynamic RLS via a user-department table; Leadership role = TRUE()

AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.