How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

[Anusha66]

I have a semantic model published in Microsoft Fabric that multiple Power BI report developers use for building reports. I want them to have read-only access to the semantic model so they can connect and create reports, but not edit or modify the model.
Are there any implications for DirectQuery or Live Connection scenarios?

Any guidance or best practices would be helpful!

[v-ssriganesh]

Hello @Anusha66,

We hope you're doing well. Could you please confirm whether your issue has been resolved or if you're still facing challenges? Your update will be valuable to the community and may assist others with similar concerns.

Thank you.

[Anusha66]

still facing issue.  without addition in create fabric objects, user is unable to access the SM from the PBI desktop

[v-ssriganesh]

Hello @Anusha66,
Please share the error message or a screenshot (with sensitive info hidden), so we 

help identify whether the issue is related to:

• Licensing (Pro/PPU requirement)

• Workspace type (Fabric-enabled workspace)

• Permissions not applying correctly

• A possible service issue

[Anusha66]

Hi theres no error as such. Basically there are 2 settings- Tenant Level and Capacity level for Fabric Items-  We had created security group to restrict other people of the organisation in using our fabric capacity.  Unless im providing access here to that user, hes unable to view the semantic model(SM) from PBI Desktop. But if i am adding the user in the security although hes able to access that SM from PBI desktop-- BUT also able to create Fabric Workspaces(with this production capacity) and therefore create all fabric objects which i do not want at this point. The users should be a like a PBI Developer using Fabric SM .

[v-ssriganesh]

Hello @Anusha66,

Thanks for the clarification. Move the semantic model to a Power BI (non-Fabric) workspace.

A Power BI-only workspace does not require Fabric capacity access.
Users can view the workspace and build reports using the SM but Cannot create Fabric items.

Best regards,
Ganesh Singamshetty.

[Anusha66]

Hi, but shouldn't my semantic model be in a Fabric Worspace as its data source is

fabric?  

[v-ssriganesh]

Hello @Anusha66,
yes, if your data source is Fabric (Lakehouse/Warehouse), then your semantic model must stay in a Fabric workspace. It cannot be hosted in a non-Fabric/Power BI-only workspace.

The challenge you're facing isn’t with the semantic model it’s with the Fabric capacity access model:

Anyone who must access items inside a Fabric workspace must also be allowed on the Fabric capacity, and capacity access automatically enables the ability to create Fabric workspaces and Fabric items. This permission is not granular yet.

If the semantic model stays in a Fabric workspace (because the data source is Fabric), then Users must have Fabric capacity access to see the SM and today, capacity access also allows creating Fabric items, there is no supported way to separate these rights yet.

So, Create a dedicated Fabric capacity for developers with stricter governance

• Control workspace creation using Entra ID governance policies to block creation even if capacity allows it.
• Keep the SM in Fabric, but let developers connect only through shared reports (limited flexibility)
  
  

Thanks,
Ganesh Singamshetty.

[Anusha66 · Accepted solution]

hi .. what i had done was -- 

adding the user in security group for creation of fabric objects. 
Through this he was able to view the semantic model from pbi desktop, while getting access to create fabric objects on trail capacities(unavoidable as of now). 

atleast the user doesnt have access on fabric production capacity, that way there will be

no billing.

[v-ssriganesh]

Hi @Anusha66,

Thanks for sharing the update.

By adding the user to the security group for creating Fabric items, they can access the semantic model from Power BI Desktop. Limiting their access to trial capacities only ensures they don’t have access to your production Fabric capacity, so there’s no billing impact.

This is a reasonable workaround until more granular Fabric capacity permissions are available.

Appreciate you sharing the outcome. it will definitely help others facing a similar scenario.

Thanks,
Ganesh Singamshetty

[v-ssriganesh]

Hello @Anusha66,
I am following up to check if you have had the opportunity to review the information provided. Please let me know if you have any questions or require further assistance.

Thank you.

[v-ssriganesh]

Hello @Anusha66,

Hope everything’s going great with you. Just checking in has the issue been resolved or are you still running into problems? Sharing an update can really help others facing the same thing.

Thank you.

[v-ssriganesh]

Hi @Anusha66,

Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to @tayloramy & @Vinodh247 for sharing valuable insights.

Could you please confirm if your query has been resolved by the provided solutions? This would be helpful for other members who may encounter similar issues.

Thank you for being part of the Microsoft Fabric Community.

[tayloramy]

Hi @Anusha66, 

I wanted to follow up here andsee if you got a solution? 

If a user is granted contriubtor in the workspace, that will override any semantic model permissions, so the suggestion to move the reports into a new worksapce where the users have contriubtor, and then only granting them read and build on the semantic models should be a good approach. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution. 

[Anusha66]

Hi, here the intent is to allow the user to create reports on Semantic Model while restricting them edit access. 
1. I have provided view access to the Workspace containing Semantic Model.
2. providing build permissions on Semantic Model

But The user is unable to access the Semantic Model without including them in creating Fabric Objects. when including them here, user is able to view the Semantic Model from PBI Desktop and was able to create reports. But this also gave the user access to creating all fabric Objects, which we dont want at this point. 

[Vinodh247]

in that case you must separate the model into a locked workspace and give report developers viewer rights there, plus build permission on the model. Nothing else reliably blocks editing afaik.

[Anusha66]

Hi Vinodh, While this worked when I added the person in the security group for creating of fabric objects, but its alo giving those report developers access to creating all fabric objects(lakehouse,warehouse etc) which shouldn't be given. can you help in how we can overcome this. 

[v-ssriganesh]

Hello @Anusha66,

Thanks for the clarification.

The behavior you're seeing is expected because the “Users can create Fabric items” tenant setting is all or nothing. if a user is included, they can create all Fabric objects. There’s currently no way to allow only some Fabric item types. Report developers do not need this setting enabled to build reports.

For your scenario, the correct setup is:

• Keep the semantic model in a workspace where developers have Viewer access.
• On the semantic model, explicitly grant Build permission only.
• Do not include them in the tenant security group for creating Fabric items.

This lets them connect and build reports while still preventing them from editing the model and from creating any Fabric objects.

Best regards,
Ganesh Singamshetty.

[Anusha66]

Hi, The user is unable to access the Semantic Model without including them in creating Fabric Objects.

[v-ssriganesh]

Hello @Anusha66,
Thanks for the update.

A user with Viewer access to the workspace + Build permission on the semantic model should be able to connect to it without being included in “Create Fabric items.” That setting is only required for creating Lakehouse/Warehouse/Pipeline objects, not for using semantic models.

If the user can access the model only when “Create Fabric items” is enabled, it usually means:

• The workspace is a Fabric-enabled workspace and the user doesn’t have a Power BI Pro/PPU license, or
• The Build permission on the semantic model didn’t apply correctly.

To fix this, try either:

• Putting the semantic model in a Power BI-only workspace or
• Ensuring the user has a Power BI Pro/PPU license.

These setups allow report building without giving permission to create Fabric objects.

[Anusha66]

We are embedding Power BI reports into another application that is available on both desktop and mobile platforms.

The report currently in use has been designed with both desktop layout and mobile layout in Power BI. While the report renders correctly within our application on desktop, we are facing issues in the mobile app, where the report does not display properly. Specifically, we are observing:

• Overlapping visuals
• Formatting/layout inconsistencies
• Improper scaling

However, the same report appears correctly in the Power BI mobile app, which indicates that the mobile layout is configured properly.

 

How can we ensure that the embedded report renders in the mobile app exactly as it does in the Power BI mobile app?

Are there any specific configurations, settings (e.g., layoutType), or best practices we should follow while embedding to support mobile layouts effectively?

Any guidance or recommendations would be greatly appreciated.

Thanks in advance!