topic Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric? in Data Warehouse

How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Anusha66 — Sat, 29 Nov 2025 05:10:43 GMT

I have a semantic model published in Microsoft Fabric that multiple Power BI report developers use for building reports. I want them to have read-only access to the semantic model so they can connect and create reports, but not edit or modify the model.
Are there any implications for DirectQuery or Live Connection scenarios?

Any guidance or best practices would be helpful!

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Vinodh247 — Sat, 29 Nov 2025 10:00:18 GMT

The cleanest way is to separate permissions at the workspace and item levels.

Keep the semantic model in a workspace where report developers have Viewer/Contributor without build.
Explicitly grant them Build permission on the semantic model only. This lets them connect and create reports, but they cannot edit or publish changes to the model.

This gives them read-only access to the model while still allowing them to build reports.

DirectQuery or Live Connection: No issues. Both require only Build permission on the semantic model. Developers can connect, query, and publish reports, but they still cannot modify the model.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Anusha66 — Sat, 29 Nov 2025 17:19:11 GMT

Hi I have tried this. It doesn't work.

Refer the MS documentation

Allow recipients to build content with the data associated with this semantic model: This option grants the recipients Build permission on the semantic model, which enables them to build new reports and dashboards based on the data associated it.
If you clear this checkbox, the user will get read-only permission on the semantic model. Read-only permission allows them to explore the semantic model on the semantic model's info page but doesn't allow them to build new content based on the semantic model.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Vinodh247 — Sun, 30 Nov 2025 04:51:27 GMT

in that case you must separate the model into a locked workspace and give report developers viewer rights there, plus build permission on the model. Nothing else reliably blocks editing afaik.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

tayloramy — Wed, 03 Dec 2025 21:33:13 GMT

Hi Anusha66,

I wanted to follow up here andsee if you got a solution?

If a user is granted contriubtor in the workspace, that will override any semantic model permissions, so the suggestion to move the reports into a new worksapce where the users have contriubtor, and then only granting them read and build on the semantic models should be a good approach.

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

v-ssriganesh — Thu, 04 Dec 2025 10:17:09 GMT

Hi Anusha66,

Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to tayloramy & Vinodh247 for sharing valuable insights.

Could you please confirm if your query has been resolved by the provided solutions? This would be helpful for other members who may encounter similar issues.

Thank you for being part of the Microsoft Fabric Community.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

v-ssriganesh — Mon, 08 Dec 2025 04:06:42 GMT

Hello Anusha66,

Hope everything’s going great with you. Just checking in has the issue been resolved or are you still running into problems? Sharing an update can really help others facing the same thing.

Thank you.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Anusha66 — Thu, 11 Dec 2025 04:43:17 GMT

Hi Vinodh, While this worked when I added the person in the security group for creating of fabric objects, but its alo giving those report developers access to creating all fabric objects(lakehouse,warehouse etc) which shouldn't be given. can you help in how we can overcome this.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

v-ssriganesh — Fri, 12 Dec 2025 07:20:57 GMT

Hello Anusha66,

Thanks for the clarification.

The behavior you're seeing is expected because the “Users can create Fabric items” tenant setting is all or nothing. if a user is included, they can create all Fabric objects. There’s currently no way to allow only some Fabric item types. Report developers do not need this setting enabled to build reports.

For your scenario, the correct setup is:

Keep the semantic model in a workspace where developers have Viewer access.
On the semantic model, explicitly grant Build permission only.
Do not include them in the tenant security group for creating Fabric items.

This lets them connect and build reports while still preventing them from editing the model and from creating any Fabric objects.

Best regards,
Ganesh Singamshetty.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

v-ssriganesh — Mon, 15 Dec 2025 04:17:03 GMT

Hello Anusha66,

We hope you're doing well. Could you please confirm whether your issue has been resolved or if you're still facing challenges? Your update will be valuable to the community and may assist others with similar concerns.

Thank you.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Anusha66 — Mon, 15 Dec 2025 10:19:49 GMT

Hi, The user is unable to access the Semantic Model without including them in creating Fabric Objects.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Anusha66 — Mon, 15 Dec 2025 10:23:43 GMT

Hi, here the intent is to allow the user to create reports on Semantic Model while restricting them edit access.
1. I have provided view access to the Workspace containing Semantic Model.
2. providing build permissions on Semantic Model

But The user is unable to access the Semantic Model without including them in creating Fabric Objects. when including them here, user is able to view the Semantic Model from PBI Desktop and was able to create reports. But this also gave the user access to creating all fabric Objects, which we dont want at this point.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

v-ssriganesh — Mon, 15 Dec 2025 12:07:53 GMT

Hello Anusha66,
Thanks for the update.

A user with Viewer access to the workspace + Build permission on the semantic model should be able to connect to it without being included in “Create Fabric items.” That setting is only required for creating Lakehouse/Warehouse/Pipeline objects, not for using semantic models.

If the user can access the model only when “Create Fabric items” is enabled, it usually means:

The workspace is a Fabric-enabled workspace and the user doesn’t have a Power BI Pro/PPU license, or
The Build permission on the semantic model didn’t apply correctly.

To fix this, try either:

Putting the semantic model in a Power BI-only workspace or
Ensuring the user has a Power BI Pro/PPU license.

These setups allow report building without giving permission to create Fabric objects.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Anusha66 — Tue, 16 Dec 2025 16:49:45 GMT

still facing issue. without addition in create fabric objects, user is unable to access the SM from the PBI desktop

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

v-ssriganesh — Wed, 17 Dec 2025 04:27:53 GMT

Hello Anusha66,
Please share the error message or a screenshot (with sensitive info hidden), so we

help identify whether the issue is related to:

Licensing (Pro/PPU requirement)
Workspace type (Fabric-enabled workspace)
Permissions not applying correctly
A possible service issue

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Anusha66 — Fri, 19 Dec 2025 10:39:11 GMT

Hi theres no error as such. Basically there are 2 settings- Tenant Level and Capacity level for Fabric Items- We had created security group to restrict other people of the organisation in using our fabric capacity. Unless im providing access here to that user, hes unable to view the semantic model(SM) from PBI Desktop. But if i am adding the user in the security although hes able to access that SM from PBI desktop-- BUT also able to create Fabric Workspaces(with this production capacity) and therefore create all fabric objects which i do not want at this point. The users should be a like a PBI Developer using Fabric SM .

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

v-ssriganesh — Fri, 19 Dec 2025 11:23:17 GMT

Hello Anusha66,

Thanks for the clarification. Move the semantic model to a Power BI (non-Fabric) workspace.

A Power BI-only workspace does not require Fabric capacity access.
Users can view the workspace and build reports using the SM but Cannot create Fabric items.

Best regards,
Ganesh Singamshetty.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

Anusha66 — Mon, 22 Dec 2025 04:17:01 GMT

Hi, but shouldn't my semantic model be in a Fabric Worspace as its data source is

fabric?

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

v-ssriganesh — Mon, 22 Dec 2025 04:45:40 GMT

Hello Anusha66,
yes, if your data source is Fabric (Lakehouse/Warehouse), then your semantic model must stay in a Fabric workspace. It cannot be hosted in a non-Fabric/Power BI-only workspace.

The challenge you're facing isn’t with the semantic model it’s with the Fabric capacity access model:

Anyone who must access items inside a Fabric workspace must also be allowed on the Fabric capacity, and capacity access automatically enables the ability to create Fabric workspaces and Fabric items. This permission is not granular yet.

If the semantic model stays in a Fabric workspace (because the data source is Fabric), then Users must have Fabric capacity access to see the SM and today, capacity access also allows creating Fabric items, there is no supported way to separate these rights yet.

So, Create a dedicated Fabric capacity for developers with stricter governance

Control workspace creation using Entra ID governance policies to block creation even if capacity allows it.
Keep the SM in Fabric, but let developers connect only through shared reports (limited flexibility)

Thanks,
Ganesh Singamshetty.

Re: How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

v-ssriganesh — Fri, 26 Dec 2025 06:47:07 GMT

Hello Anusha66,
I am following up to check if you have had the opportunity to review the information provided. Please let me know if you have any questions or require further assistance.

Thank you.