Forum Discussion

Anusha66's avatar
Anusha66
Icon for Advocate IV rankAdvocate IV
9 months ago
Solved

How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

I have a semantic model published in Microsoft Fabric that multiple Power BI report developers use for building reports. I want them to have read-only access to the semantic model so they can connect...
data warehouse
  • Anusha66's avatar
    Anusha66
    8 months ago

    hi .. what i had done was -- 

     

    adding the user in security group for creation of fabric objects. 
    Through this he was able to view the semantic model from pbi desktop, while getting access to create fabric objects on trail capacities(unavoidable as of now). 

    atleast the user doesnt have access on fabric production capacity, that way there will be

    no billing.

Vinodh247's avatar
Vinodh247
Icon for Super User rankSuper User
9 months ago

in that case you must separate the model into a locked workspace and give report developers viewer rights there, plus build permission on the model. Nothing else reliably blocks editing afaik.

  • Anusha66's avatar
    Anusha66
    Icon for Advocate IV rankAdvocate IV
    9 months ago

    Hi Vinodh, While this worked when I added the person in the security group for creating of fabric objects, but its alo giving those report developers access to creating all fabric objects(lakehouse,warehouse etc) which shouldn't be given. can you help in how we can overcome this. 

     

    • v-ssriganesh's avatar
      v-ssriganesh
      Icon for Community Support rankCommunity Support
      9 months ago

      Hello Anusha66,

      Thanks for the clarification.

      The behavior you're seeing is expected because the “Users can create Fabric items” tenant setting is all or nothing. if a user is included, they can create all Fabric objects. There’s currently no way to allow only some Fabric item types. Report developers do not need this setting enabled to build reports.

      For your scenario, the correct setup is:

      • Keep the semantic model in a workspace where developers have Viewer access.
      • On the semantic model, explicitly grant Build permission only.
      • Do not include them in the tenant security group for creating Fabric items.

      This lets them connect and build reports while still preventing them from editing the model and from creating any Fabric objects.

      Best regards,
      Ganesh Singamshetty.

      • Anusha66's avatar
        Anusha66
        Icon for Advocate IV rankAdvocate IV
        8 months ago

        Hi, The user is unable to access the Semantic Model without including them in creating Fabric Objects.