Forum Discussion
Advocate IVHow to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?
I have a semantic model published in Microsoft Fabric that multiple Power BI report developers use for building reports. I want them to have read-only access to the semantic model so they can connect and create reports, but not edit or modify the model.
Are there any implications for DirectQuery or Live Connection scenarios?
Any guidance or best practices would be helpful!
hi .. what i had done was --
adding the user in security group for creation of fabric objects.
Through this he was able to view the semantic model from pbi desktop, while getting access to create fabric objects on trail capacities(unavoidable as of now).
atleast the user doesnt have access on fabric production capacity, that way there will beno billing.
24 Replies
- Vinodh247
Super User
in that case you must separate the model into a locked workspace and give report developers viewer rights there, plus build permission on the model. Nothing else reliably blocks editing afaik.
Anusha66Hi Vinodh, While this worked when I added the person in the security group for creating of fabric objects, but its alo giving those report developers access to creating all fabric objects(lakehouse,warehouse etc) which shouldn't be given. can you help in how we can overcome this.
v-ssriganeshCommunity Support
Hello Anusha66,
Thanks for the clarification.
The behavior you're seeing is expected because the “Users can create Fabric items” tenant setting is all or nothing. if a user is included, they can create all Fabric objects. There’s currently no way to allow only some Fabric item types. Report developers do not need this setting enabled to build reports.
For your scenario, the correct setup is:
- Keep the semantic model in a workspace where developers have Viewer access.
- On the semantic model, explicitly grant Build permission only.
- Do not include them in the tenant security group for creating Fabric items.
This lets them connect and build reports while still preventing them from editing the model and from creating any Fabric objects.
Best regards,
Ganesh Singamshetty.
- tayloramy
Hi Anusha66,
I wanted to follow up here andsee if you got a solution?
If a user is granted contriubtor in the workspace, that will override any semantic model permissions, so the suggestion to move the reports into a new worksapce where the users have contriubtor, and then only granting them read and build on the semantic models should be a good approach.
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.
- Anusha66
Hi, here the intent is to allow the user to create reports on Semantic Model while restricting them edit access.
1. I have provided view access to the Workspace containing Semantic Model.
2. providing build permissions on Semantic Model
But The user is unable to access the Semantic Model without including them in creating Fabric Objects. when including them here, user is able to view the Semantic Model from PBI Desktop and was able to create reports. But this also gave the user access to creating all fabric Objects, which we dont want at this point.
- Vinodh247
The cleanest way is to separate permissions at the workspace and item levels.
Keep the semantic model in a workspace where report developers have Viewer/Contributor without build.
Explicitly grant them Build permission on the semantic model only. This lets them connect and create reports, but they cannot edit or publish changes to the model.
This gives them read-only access to the model while still allowing them to build reports.
DirectQuery or Live Connection: No issues. Both require only Build permission on the semantic model. Developers can connect, query, and publish reports, but they still cannot modify the model.
- Anusha66
Hi I have tried this. It doesn't work.
Refer the MS documentationAllow recipients to build content with the data associated with this semantic model: This option grants the recipients Build permission on the semantic model, which enables them to build new reports and dashboards based on the data associated it.
If you clear this checkbox, the user will get read-only permission on the semantic model. Read-only permission allows them to explore the semantic model on the semantic model's info page but doesn't allow them to build new content based on the semantic model.
- v-ssriganesh
Hi Anusha66,
Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to tayloramy & Vinodh247 for sharing valuable insights.
Could you please confirm if your query has been resolved by the provided solutions? This would be helpful for other members who may encounter similar issues.
Thank you for being part of the Microsoft Fabric Community.
- v-ssriganesh
Hello Anusha66,
Hope everything’s going great with you. Just checking in has the issue been resolved or are you still running into problems? Sharing an update can really help others facing the same thing.
Thank you.
- v-ssriganesh
Hello Anusha66,
We hope you're doing well. Could you please confirm whether your issue has been resolved or if you're still facing challenges? Your update will be valuable to the community and may assist others with similar concerns.
Thank you.
- Anusha66
still facing issue. without addition in create fabric objects, user is unable to access the SM from the PBI desktop
- v-ssriganesh
Hello Anusha66,
Please share the error message or a screenshot (with sensitive info hidden), so wehelp identify whether the issue is related to:
-
Licensing (Pro/PPU requirement)
-
Workspace type (Fabric-enabled workspace)
-
Permissions not applying correctly
-
A possible service issue
-
Thanks
