Forum Discussion

Anusha66's avatar
Anusha66
Icon for Advocate IV rankAdvocate IV
9 months ago
Solved

How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

I have a semantic model published in Microsoft Fabric that multiple Power BI report developers use for building reports. I want them to have read-only access to the semantic model so they can connect...
data warehouse
  • Anusha66's avatar
    Anusha66
    8 months ago

    hi .. what i had done was -- 

     

    adding the user in security group for creation of fabric objects. 
    Through this he was able to view the semantic model from pbi desktop, while getting access to create fabric objects on trail capacities(unavoidable as of now). 

    atleast the user doesnt have access on fabric production capacity, that way there will be

    no billing.

Vinodh247's avatar
Vinodh247
Icon for Super User rankSuper User
9 months ago

in that case you must separate the model into a locked workspace and give report developers viewer rights there, plus build permission on the model. Nothing else reliably blocks editing afaik.

Anusha66's avatar
Anusha66
Icon for Advocate IV rankAdvocate IV
9 months ago

Hi Vinodh, While this worked when I added the person in the security group for creating of fabric objects, but its alo giving those report developers access to creating all fabric objects(lakehouse,warehouse etc) which shouldn't be given. can you help in how we can overcome this. 

 

  • v-ssriganesh's avatar
    v-ssriganesh
    Icon for Community Support rankCommunity Support
    8 months ago

    Hello Anusha66,

    Thanks for the clarification.

    The behavior you're seeing is expected because the “Users can create Fabric items” tenant setting is all or nothing. if a user is included, they can create all Fabric objects. There’s currently no way to allow only some Fabric item types. Report developers do not need this setting enabled to build reports.

    For your scenario, the correct setup is:

    • Keep the semantic model in a workspace where developers have Viewer access.
    • On the semantic model, explicitly grant Build permission only.
    • Do not include them in the tenant security group for creating Fabric items.

    This lets them connect and build reports while still preventing them from editing the model and from creating any Fabric objects.

    Best regards,
    Ganesh Singamshetty.

    • Anusha66's avatar
      Anusha66
      Icon for Advocate IV rankAdvocate IV
      8 months ago

      Hi, The user is unable to access the Semantic Model without including them in creating Fabric Objects.

      • v-ssriganesh's avatar
        v-ssriganesh
        Icon for Community Support rankCommunity Support
        8 months ago

        Hello Anusha66,
        Thanks for the update.

        A user with Viewer access to the workspace + Build permission on the semantic model should be able to connect to it without being included in “Create Fabric items.” That setting is only required for creating Lakehouse/Warehouse/Pipeline objects, not for using semantic models.

        If the user can access the model only when “Create Fabric items” is enabled, it usually means:

        • The workspace is a Fabric-enabled workspace and the user doesn’t have a Power BI Pro/PPU license, or
        • The Build permission on the semantic model didn’t apply correctly.

        To fix this, try either:

        • Putting the semantic model in a Power BI-only workspace or
        • Ensuring the user has a Power BI Pro/PPU license.

        These setups allow report building without giving permission to create Fabric objects.