Forum Discussion

Anusha66's avatar
Anusha66
Icon for Advocate IV rankAdvocate IV
9 months ago
Solved

How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

I have a semantic model published in Microsoft Fabric that multiple Power BI report developers use for building reports. I want them to have read-only access to the semantic model so they can connect...
data warehouse
  • Anusha66's avatar
    Anusha66
    8 months ago

    hi .. what i had done was -- 

     

    adding the user in security group for creation of fabric objects. 
    Through this he was able to view the semantic model from pbi desktop, while getting access to create fabric objects on trail capacities(unavoidable as of now). 

    atleast the user doesnt have access on fabric production capacity, that way there will be

    no billing.

v-ssriganesh's avatar
v-ssriganesh
Icon for Community Support rankCommunity Support
8 months ago

Hello Anusha66,
Please share the error message or a screenshot (with sensitive info hidden), so we 

help identify whether the issue is related to:

  • Licensing (Pro/PPU requirement)

  • Workspace type (Fabric-enabled workspace)

  • Permissions not applying correctly

  • A possible service issue

Anusha66's avatar
Anusha66
Icon for Advocate IV rankAdvocate IV
8 months ago

Hi theres no error as such. Basically there are 2 settings- Tenant Level and Capacity level for Fabric Items-  We had created security group to restrict other people of the organisation in using our fabric capacity.  Unless im providing access here to that user, hes unable to view the semantic model(SM) from PBI Desktop. But if i am adding the user in the security although hes able to access that SM from PBI desktop-- BUT also able to create Fabric Workspaces(with this production capacity) and therefore create all fabric objects which i do not want at this point. The users should be a like a PBI Developer using Fabric SM .


 

  • v-ssriganesh's avatar
    v-ssriganesh
    Icon for Community Support rankCommunity Support
    8 months ago

    Hello Anusha66,

    Thanks for the clarification. Move the semantic model to a Power BI (non-Fabric) workspace.

    A Power BI-only workspace does not require Fabric capacity access.
    Users can view the workspace and build reports using the SM but Cannot create Fabric items.

    Best regards,
    Ganesh Singamshetty.

    • Anusha66's avatar
      Anusha66
      Icon for Advocate IV rankAdvocate IV
      8 months ago

      Hi, but shouldn't my semantic model be in a Fabric Worspace as its data source is

      fabric?  

       

      • v-ssriganesh's avatar
        v-ssriganesh
        Icon for Community Support rankCommunity Support
        8 months ago

        Hello Anusha66,
        yes, if your data source is Fabric (Lakehouse/Warehouse), then your semantic model must stay in a Fabric workspace. It cannot be hosted in a non-Fabric/Power BI-only workspace.

        The challenge you're facing isn’t with the semantic model it’s with the Fabric capacity access model:

        Anyone who must access items inside a Fabric workspace must also be allowed on the Fabric capacity, and capacity access automatically enables the ability to create Fabric workspaces and Fabric items. This permission is not granular yet.

        If the semantic model stays in a Fabric workspace (because the data source is Fabric), then Users must have Fabric capacity access to see the SM and today, capacity access also allows creating Fabric items, there is no supported way to separate these rights yet.

        So, Create a dedicated Fabric capacity for developers with stricter governance

        • Control workspace creation using Entra ID governance policies to block creation even if capacity allows it.
        • Keep the SM in Fabric, but let developers connect only through shared reports (limited flexibility)

        Thanks,
        Ganesh Singamshetty.