Forum Discussion
Cannot Load Model
Hi PowerMBS ,
From what you describe, the permissions side looks fine. That message isn't an access issue, i think that t's an error coming from the semantic model engine related to Row-Level Security (RLS).
This error can shows up when the same user ends up assigned to more than one role in the model and the combination of filters (especially with dynamic security using USERPRINCIPALNAME(), or when mixing RLS with OLS) becomes inconsistent for the engine.
I would like to ask you to verify the following:
- How many roles are defined in the semantic model and what type they are (static, dynamic or a mix).
- Whether the same user or AD group is assigned to more than one role at the same time.
- Whether you also have OLS (Object Level Security) configured, since combining OLS with dynamic RLS is a very common cause of this exact error.
Official documentation for reference:
https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance
https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security
If this helped, please consider giving it a Like. If it solved your issue, please mark it as the Accepted Solution to help others facing the same problem.
Thanks
Hello PowerMBS,
The error in your screenshot points to a Row-Level Security (RLS) configuration issue rather than a semantic model refresh problem.
"The combination of active roles results in a dynamic security configuration that is not consistent."This typically occurs when a user is assigned to multiple RLS roles whose filters conflict or create an invalid security context.
I'd recommend checking the following:
Verify whether the affected users belong to multiple RLS roles in the semantic model.
Review the DAX filters defined for each role and ensure they don't conflict with one another.
Use View as in Power BI Desktop to test each role individually and then in combination.
If the semantic model uses dynamic RLS (for example, based on USERPRINCIPALNAME(), ensure the security mapping table doesn't return conflicting or duplicate role assignments for the same user.
Since only some users are affected, comparing their role memberships with users who can successfully open the report should help identify the conflicting security configuration.
Best regards,
Omkar Shinde
Microsoft Fabric Enthusiast | Power BI Consultant
💡 If you found this response helpful, please consider giving it a Kudos.
✅ If this resolves your question, please mark it as the Accepted Solution to help others in the community.Hi PowerMBS,
Based on my experience with Microsoft Fabric, I would first verify that users have access to all dependent Fabric objects, not just the report.
This includes the 1. Lakehouse (if Direct Lake is used), 2. SQL Endpoint, 3. Semantic Model, 4. Report, and any 5. Dashboard/App.
But most importantly in your case, you should review the Row-Level Security (RLS) configuration carefully.
The error in your screenshot often points to conflicting or inconsistent RLS roles rather than missing workspace permissions.
Since users don't have workspace access, ensure they have the required permissions on the semantic model and that they aren't members of multiple RLS roles that conflict with each other.
Super UserThis is almost always a permissions issue rather than a refresh issue. When a report in an app reads from a semantic model that lives in a different workspace, the viewer needs Build permission on that semantic model on top of the app access, otherwise the model fails to load even though the rest of the app is visible.
Go to the workspace that hosts the semantic model, open the model's More options menu, choose Manage permissions, and grant the affected users or the security group Read and Build. Once that propagates the report will load without needing the hourly refresh workaround.
If this fixes it, please mark it as the accepted solution and give a thumbs up.
Thanks,
Shai Karmani
Users are given access through AD security to the report, semantic model, lakehouse, semantic model. Users do not have workspace access. Only content developers are setup with workspace access and build writes. Even people with Contributer access to the workspace cant even open the report
- arabalca
Hi PowerMBS ,
From what you describe, the permissions side looks fine. That message isn't an access issue, i think that t's an error coming from the semantic model engine related to Row-Level Security (RLS).
This error can shows up when the same user ends up assigned to more than one role in the model and the combination of filters (especially with dynamic security using USERPRINCIPALNAME(), or when mixing RLS with OLS) becomes inconsistent for the engine.
I would like to ask you to verify the following:
- How many roles are defined in the semantic model and what type they are (static, dynamic or a mix).
- Whether the same user or AD group is assigned to more than one role at the same time.
- Whether you also have OLS (Object Level Security) configured, since combining OLS with dynamic RLS is a very common cause of this exact error.
Official documentation for reference:
https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance
https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security
If this helped, please consider giving it a Like. If it solved your issue, please mark it as the Accepted Solution to help others facing the same problem.
Thanks
Hi PowerMBS,
Based on my experience with Microsoft Fabric, I would first verify that users have access to all dependent Fabric objects, not just the report.
This includes the 1. Lakehouse (if Direct Lake is used), 2. SQL Endpoint, 3. Semantic Model, 4. Report, and any 5. Dashboard/App.
But most importantly in your case, you should review the Row-Level Security (RLS) configuration carefully.
The error in your screenshot often points to conflicting or inconsistent RLS roles rather than missing workspace permissions.
Since users don't have workspace access, ensure they have the required permissions on the semantic model and that they aren't members of multiple RLS roles that conflict with each other.