Org App doesn't grant semantic model access although report and model are in the same workspace

This is actually expected behavior with Org Apps. Granting users access to the app gives them implicit Read on the underlying semantic model only for the queries served through the report visuals in the app. It does not grant Build, which is why anything that needs to talk to the model directly fails (Analyze in Excel, building a new report on top of the model, XMLA endpoint access, copying the report, etc).

The clean fix without re-sharing the workspace is in Manage app. Open Manage app, go to the Audience tab, expand the audience and find the dataset / semantic model permissions, and turn on "Allow recipients to build content with the data associated with this app". Then republish. After republish, the audience gets Build on the model alongside the app.

If you only want a subset of users to build, skip the app setting and grant Build directly on the semantic model from its workspace (Manage permissions on the model). Either path gives them what they are missing now. App audience changes only take effect after republishing, so any change there must be followed by Update app.

If this helped, a thumbs up and accepting the solution would be appreciated.

Best regards,
Shai Karmani

Let's connect in LinkedIn

P108 or you can give the explicit build permission on the semantic model.

The issue is most likely not with the Org App itself. Access to an Org App does not always grant Build permission on the underlying semantic model. As a result, users can view reports within the app, but they cannot directly access the semantic model or use it to create new reports.

Recommended troubleshooting steps:

1. Verify the permissions assigned to the semantic model.

2. Ensure that the affected users or security groups have been granted Build permission in addition to Read access.

3. Review any Composite Models or chained semantic model dependencies and confirm that permissions are correctly assigned across all related models.

4. Check whether Row-Level Security (RLS) or other security configurations are affecting access.

5. Republish the app after making any permission changes and validate the behavior with a test user account

Hi,

When you share an app, your audience automatically receives Read permissions on the underlying semantic models to view the reports, but they do not get Build rights by default. In the Manage audience access pane of the app, expand Advanced and enable “Allow users to build content with the semantic models in this app.” This setting grants Build permissions on the models included and lets your users connect to them from the Dataset hub or Excel.

If the semantic model is stored in a different workspace, the app cannot propagate Build permissions across workspaces – you need to add the users to that workspace as at least Viewer or explicitly grant them Build on the dataset. Also be aware that if the model uses row‑level security, users must belong to one of its RLS roles to see data even when they have Build rights.

Hope this helps!

Hi P108 , Thank you for reaching out to the Microsoft Community Forum.

We find the answers shared by Shai_Karmani , rampie , parry2k & Ruba_hassan are correct. Can you please confirm if the solution worked for you. It will help others with similar issues find the answer easily.

Thank you rampie , Shai_Karmani parry2k & Ruba_hassan for your valuable responses.