Forum Discussion
PowerBINotAuthorizedException (401) when accessing semantic model despite Read/Build permissions
Hi all,
I have a user who can see a Power BI semantic model in Get Data > Power BI Semantic Models, but when they connect, no tables are visible. If they open the semantic model in the Service, they receive:
PowerBINotAuthorizedException
Status code: 401
We already verified:
- The user has a Power BI Pro licence.
- The user has Read and Build permissions on the semantic model.
- Permissions have been removed and re-added.
- No RLS or OLS is configured.
- A separate test account with the same semantic model permissions can access the model and see all tables successfully.
- The test account does not have workspace access, so workspace permissions do not appear to be the issue.
Given that the test account can access the model with the same permissions, this seems to be a user-specific authorisation issue rather than a semantic model config issue.
Has anyone encountered a similar scenario or have any suggestions on what to investigate next?
Thanks!
Hi svac
I've hit this exact `PowerBINotAuthorizedException 401` before. Since your test account works with same Read/Build, this is almost always a user/token/license sync issue, not model permissions.
Here are the 3 things to check in order:
1. Check "Effective Access" + XMLA Endpoint Permission
Read/Build is not enough for "Get Data > Power BI Semantic Models".
1. Go to Workspace > Semantic Model > `Manage permissions`
2. Click `...` > `Manage permissions` > `Access` tab
3. Click `Test` next to the user. Check if it says "Can Read" AND "Can Build".
4. CRITICAL: Go to Workspace Settings > `Premium` > `License mode`.
Make sure "Allow XMLA read/write" is ON if you are using Premium/PPU.
For Pro: Go to Admin Portal > Tenant Settings > `XMLA endpoint` > Enable "Read" for Pro users.
If XMLA is blocked, you get 401 even with Read/Build.2. Clear Cache / Re-authenticate the user
This is the #1 fix for user-specific 401.
Have the user do this:
1. Power BI Desktop > `File` > `Options and settings` > `Data source settings` > `Clear Permissions` > Clear All
2. `File` > `Options and settings` > `Options` > `Security` > `Clear Cache`
3. Sign out of Power BI Desktop completely and sign back in.
Sometimes the AAD token gets stuck with old permissions.3. Check Hidden Blockers
Since test account works:
1. Conditional Access : Check Azure AD > Security > Conditional Access. Is there a policy blocking this specific user from "Power BI Service" app?
2. Guest vs Member : Is the problem user a Guest in AAD? Guests often get 401 on semantic models even with Read/Build. Make them Member.
3. License Propagation : Remove Pro license from user, wait 15 min, re-assign Pro license. Then wait 1 hour. License sync lag causes this.My bet: 80% chance it's #2 Cache, 15% chance it's #1 XMLA setting, 5% chance it's #3 Guest/CA policy.
Let me know which one worked. If none work, check `Admin Portal > Audit Logs` for that user at the exact time of 401 - it will tell you the real reason.
5 Replies
Few questions here
Does the user's ID who is facing this issue is in your tenant or it is in a different tenant and it is a B2B guest user ID?
If it is a B2B guest user id then you need to make sure necessary settings are turned on in the admin portal.
Connect on LinkedIn
you can read my blogs here: https://www.techietips.co.in/
Did I answer your question? Mark my post as a solution! If I helped you, click on the Thumbs Up to give Kudos.
Proud to be a Super User!
Hi svac ,
Could you please review the suggestion provided above and let us know if you still have any further questions?
Thanks!!
Hi svac
I've hit this exact `PowerBINotAuthorizedException 401` before. Since your test account works with same Read/Build, this is almost always a user/token/license sync issue, not model permissions.
Here are the 3 things to check in order:
1. Check "Effective Access" + XMLA Endpoint Permission
Read/Build is not enough for "Get Data > Power BI Semantic Models".
1. Go to Workspace > Semantic Model > `Manage permissions`
2. Click `...` > `Manage permissions` > `Access` tab
3. Click `Test` next to the user. Check if it says "Can Read" AND "Can Build".
4. CRITICAL: Go to Workspace Settings > `Premium` > `License mode`.
Make sure "Allow XMLA read/write" is ON if you are using Premium/PPU.
For Pro: Go to Admin Portal > Tenant Settings > `XMLA endpoint` > Enable "Read" for Pro users.
If XMLA is blocked, you get 401 even with Read/Build.2. Clear Cache / Re-authenticate the user
This is the #1 fix for user-specific 401.
Have the user do this:
1. Power BI Desktop > `File` > `Options and settings` > `Data source settings` > `Clear Permissions` > Clear All
2. `File` > `Options and settings` > `Options` > `Security` > `Clear Cache`
3. Sign out of Power BI Desktop completely and sign back in.
Sometimes the AAD token gets stuck with old permissions.3. Check Hidden Blockers
Since test account works:
1. Conditional Access : Check Azure AD > Security > Conditional Access. Is there a policy blocking this specific user from "Power BI Service" app?
2. Guest vs Member : Is the problem user a Guest in AAD? Guests often get 401 on semantic models even with Read/Build. Make them Member.
3. License Propagation : Remove Pro license from user, wait 15 min, re-assign Pro license. Then wait 1 hour. License sync lag causes this.My bet: 80% chance it's #2 Cache, 15% chance it's #1 XMLA setting, 5% chance it's #3 Guest/CA policy.
Let me know which one worked. If none work, check `Admin Portal > Audit Logs` for that user at the exact time of 401 - it will tell you the real reason.
Since a test account with the same permissions works, it's the user identity, not the model. Most likely a sensitivity label with encryption (rights come from the label policy, not Build) or a Conditional Access policy blocking that user. Check the Entra sign-in log for that user, filtered to the Power BI Service app, around the time of the 401.
Paco
Helping data analytics leaders distribute their reportsHi svac ,
Could you please check the suggestions provided and let us know if you have any further questions.
Thanks!!
