PowerBINotAuthorizedException (401) when accessing semantic model despite Read/Build permissions

Hi svac 

I've hit this exact `PowerBINotAuthorizedException 401` before. Since your test account works with same Read/Build, this is almost always a user/token/license sync issue, not model permissions.

Here are the 3 things to check in order:

1. Check "Effective Access" + XMLA Endpoint Permission
Read/Build is not enough for "Get Data > Power BI Semantic Models".
1. Go to Workspace > Semantic Model > `Manage permissions`
2. Click `...` > `Manage permissions` > `Access` tab
3. Click `Test` next to the user. Check if it says "Can Read" AND "Can Build".
4. CRITICAL: Go to Workspace Settings > `Premium` > `License mode`.
Make sure "Allow XMLA read/write" is ON if you are using Premium/PPU.
For Pro: Go to Admin Portal > Tenant Settings > `XMLA endpoint` > Enable "Read" for Pro users.
If XMLA is blocked, you get 401 even with Read/Build.

2. Clear Cache / Re-authenticate the user
This is the #1 fix for user-specific 401.
Have the user do this:
1. Power BI Desktop > `File` > `Options and settings` > `Data source settings` > `Clear Permissions` > Clear All
2. `File` > `Options and settings` > `Options` > `Security` > `Clear Cache`
3. Sign out of Power BI Desktop completely and sign back in.
Sometimes the AAD token gets stuck with old permissions.

3. Check Hidden Blockers
Since test account works:
1. Conditional Access : Check Azure AD > Security > Conditional Access. Is there a policy blocking this specific user from "Power BI Service" app?
2. Guest vs Member : Is the problem user a Guest in AAD? Guests often get 401 on semantic models even with Read/Build. Make them Member.
3. License Propagation : Remove Pro license from user, wait 15 min, re-assign Pro license. Then wait 1 hour. License sync lag causes this.

My bet: 80% chance it's #2 Cache, 15% chance it's #1 XMLA setting, 5% chance it's #3 Guest/CA policy.

Let me know which one worked. If none work, check `Admin Portal > Audit Logs` for that user at the exact time of 401 - it will tell you the real reason.