Forum Discussion

Anusha66's avatar
Anusha66
Icon for Advocate IV rankAdvocate IV
9 months ago
Solved

How to restrict Power BI report developers from editing a semantic model in Microsoft Fabric?

I have a semantic model published in Microsoft Fabric that multiple Power BI report developers use for building reports. I want them to have read-only access to the semantic model so they can connect...
data warehouse
  • Anusha66's avatar
    Anusha66
    8 months ago

    hi .. what i had done was -- 

     

    adding the user in security group for creation of fabric objects. 
    Through this he was able to view the semantic model from pbi desktop, while getting access to create fabric objects on trail capacities(unavoidable as of now). 

    atleast the user doesnt have access on fabric production capacity, that way there will be

    no billing.

v-ssriganesh's avatar
v-ssriganesh
Icon for Community Support rankCommunity Support
8 months ago

Hello Anusha66,
yes, if your data source is Fabric (Lakehouse/Warehouse), then your semantic model must stay in a Fabric workspace. It cannot be hosted in a non-Fabric/Power BI-only workspace.

The challenge you're facing isn’t with the semantic model it’s with the Fabric capacity access model:

Anyone who must access items inside a Fabric workspace must also be allowed on the Fabric capacity, and capacity access automatically enables the ability to create Fabric workspaces and Fabric items. This permission is not granular yet.

If the semantic model stays in a Fabric workspace (because the data source is Fabric), then Users must have Fabric capacity access to see the SM and today, capacity access also allows creating Fabric items, there is no supported way to separate these rights yet.

So, Create a dedicated Fabric capacity for developers with stricter governance

  • Control workspace creation using Entra ID governance policies to block creation even if capacity allows it.
  • Keep the SM in Fabric, but let developers connect only through shared reports (limited flexibility)

Thanks,
Ganesh Singamshetty.

Anusha66's avatar
Anusha66
Icon for Advocate IV rankAdvocate IV
8 months ago

hi .. what i had done was -- 

 

adding the user in security group for creation of fabric objects. 
Through this he was able to view the semantic model from pbi desktop, while getting access to create fabric objects on trail capacities(unavoidable as of now). 

atleast the user doesnt have access on fabric production capacity, that way there will be

no billing.

  • v-ssriganesh's avatar
    v-ssriganesh
    Icon for Community Support rankCommunity Support
    8 months ago

    Hi Anusha66,

    Thanks for sharing the update.

    By adding the user to the security group for creating Fabric items, they can access the semantic model from Power BI Desktop. Limiting their access to trial capacities only ensures they don’t have access to your production Fabric capacity, so there’s no billing impact.

    This is a reasonable workaround until more granular Fabric capacity permissions are available.

    Appreciate you sharing the outcome. it will definitely help others facing a similar scenario.

    Thanks,
    Ganesh Singamshetty