How can I hide guest users to read the semantic model?

[info_algoritmia]

Hey, I have a question more technical, I created an app, but wondering if there is an option to restrict the view of the semantic model, I dont even want the users to see how many tables i' using or columns, in the app view when they click on the three dots they will see the option "view semantic model" as the screenshot shows below

however, they cannot perform any action BUT still can see the table structure at the right corner

is there a way to hide this? I'm not that technical in powerbi when it comes to permissions, so please help me with a clear and simple answer that I can follow along in case I can accomplish this, thanks a lot

[Shravan133]

Users with Read permission can view semantic model settings, including table structures. To restrict this:​

• Remove direct access permissions:​
• Navigate to the semantic model in the Power BI Service.​
• Click on the ellipsis (...) next to the model and select Manage Permissions.​
• In the Direct access tab, remove users or groups who shouldn't view the model structure.​
• Manage permissions granted through apps:​
• Edit the app associated with the semantic model.​
• In the Permissions tab, unselect the relevant permissions for users or groups.​
• Republish the app.​
• After republishing, go back to the Direct access tab of the semantic model's permissions and remove any residual permissions not tied to the app.​

[info_algoritmia]

@Shravan133 Im on the option "manage permissions" but this is what I see, I want to prevent the user Chris test 2 to see the semantic structure, he has "App" permissions, but I dont have any option to remove or edit that, if I click on the 3 dots the only I see is "add share, add build, add write" but doesnt say "delete" or edit what he can see

[v-achippa]

Hi @info_algoritmia,

Thank you for reaching out to Microsoft Fabric Community.

Yes, if a user like Chris test 2 has only App-level permissions, you won’t be able to edit or remove them directly in the ‘Manage Permissions’ pane because that access is inherited from the app.

However, even with just app access, power bi still exposes the ‘View semantic model’ option if the dataset is part of the same workspace and included in the app.

To fully prevent users from viewing the semantic model structure, use a Thin Report model:

• Move the dataset to a separate workspace (not shared with guests).
• Build a live-connected report using like go to Get Data → Power BI Datasets
• Publish this report to the workspace used for your app.
• Share only the report in the app, not the dataset.

This way, users can still view and interact with the report, but the semantic model will be hidden.

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it! 

Thanks and regards,

Anjan Kumar Chippa

[info_algoritmia]

@v-achippa  I followed your steps this way

-- create a new workspace (let's called it workspace A) so here I publish the original report with the data semantic model 

-- then, create a new report connected via PowerBI semantic model with the model from the report in workspace A 

-- Create a new workspace (Let's call it Workspace B) and publish the report created using the semantic model as data source (so here I only see the report created, there are no semantic models in this workspace B)

-- Then create the app in workspace B, and share access here to the user (keep in mind the user is a guest external user added in microsoft entra and it has no access to workspace A where the semantic model is). The thing is I got this error 

The guest user cannot see the app if it doesn't have access to the semantic model

Maybe I'm doing something wrong? Please help me with this

-

[v-achippa · Accepted solution]

Hi @info_algoritmia,

The issue you are experiencing is expected behavior when using cross-workspace semantic models with external guest users.

By default, even though the semantic model is hidden in Workspace A, power bi still requires the Build permission on the dataset for users to be able to render reports connected to it even if those reports are hosted in a different workspace.

Go to Workspace A where the semantic model is, locate the semantic model (dataset) and click the three dots (...) --> “Manage Permissions”. Under Direct Access add the guest user and give them only Build permission.

This will give the user just enough access to view the report in the app, without exposing the semantic model structure.

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it! 

Thanks and regards,

Anjan Kumar Chippa

[v-achippa]

Hi @info_algoritmia,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution I have provided, resolved your issue.
If my response resolved your issue, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

Thanks and regards,

Anjan Kumar Chippa

[v-achippa]

Hi @info_algoritmia,

We wanted to kindly follow up to check if the solution I have provided, resolved your issue.
If my response resolved your issue, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

Thanks and regards,

Anjan Kumar Chippa

[v-achippa]

Hi @info_algoritmia,

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution I have provided, resolved your issue.
If my response resolved your issue, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

Thanks and regards,

Anjan Kumar Chippa

[info_algoritmia]

hi I will check it out today and let you know if it worked

thanks

[info_algoritmia]

@v-achippa hey what do you mean with this

"Build a live-connected report using like go to Get Data → Power BI Datasets" 

how do I do that? how do I create a powerbi dataset? is this done on Deskptop or Service?

[info_algoritmia]

Got this error, I'm the admin, do you know where do I need to go to enable this?