Power BI Apps - Audience seems not enough & Power BI REST API doesn't support direct read assignment

 Hey lachicazul ,

I have no idea what you mean by "Report level: Build permission."
Build permission granted on a semantic model.

If your semantic model and the workspace app are hosted in different workspaces, the app's audiences need read permission on the semantic model. Build permission on the semantic model is not required for workspace app consumers (the users were added to the app's audiences).

Regards,
Tom

Hi lachicazul,

Thank you for the update.

As the proposed solution did not resolve your issue, we kindly request that you open a Microsoft Support ticket for a more detailed investigation using the following link:Microsoft Fabric Support and Status | Microsoft Fabric

If you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.

Thankyou, TomMartens, for your response.

Hi lachicazul,

Thank you for your inquiry on the Microsoft Fabric Community Forum.

Based on my understanding, when a report is redeployed through CI/CD (for example, using the REST API or import), the report object is frequently recreated or updated in a manner that causes item level Read or Reshare permissions on the report to be lost. At present, Microsoft does not offer a fully supported REST API that reliably sets persistent per report Read or Reshare permissions which remain after a replacement. Consequently, the report level Read assignment may be removed after publishing.

Please follow the steps below, which may help resolve the issue:

1. Grant the AAD group the Viewer role on the reporting workspace so users can always see the reports and the app. Alternatively, use the App Audiences feature when publishing the app (add your group as an audience). This ensures that audience access remains intact even when a report is redeployed.
2. Grant the authors or Power BI report authors the Build permission on the dataset or semantic model in the semantic models workspace. Consumers of the app generally do not require Build, they typically need only View access via the app or workspace.

For further reference, please see the links below:
Build Permission for Shared Semantic Models - Power BI | Microsoft Learn
Groups - Add Group User - REST API (Power BI Power BI REST APIs) | Microsoft Learn
Publish an app in Power BI - Power BI | Microsoft Learn
Reports - Update Report Content In Group - REST API (Power BI Power BI REST APIs) | Microsoft Learn

We hope the information provided helps to resolve your issue. If you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.

Hi lachicazul,

Thankyou for the followup.

As per my understanding, you do not need to grant Viewer access to the workspace for all 1,000 users. The confusion appears to arise because report level Read permissions are lost on redeploy. However, App access operates differently. Users can consume reports through the App without being workspace members.

Please find below the purpose and benefits of using an App:

1. Apps are designed to distribute content to large audiences securely without granting them access to the workspace.
2. Add your Entra (AAD) groups directly as App audiences, this allows users to view reports in the App while keeping the workspace restricted to developers.
3. Use workspace roles (Admin/Member/Contributor/Viewer) only for creators or CI/CD automation, not for end users.
4. The App serves as the managed consumption layer. Workspace access should remain limited.
5. This approach preserves security and scalability while supporting clear governance.

We hope the information provided will help resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.

Hi lachicazul,

Thank you for the follow up.

Based on my understanding, the issue arises because the reports in your app are connected to a semantic model or dataset stored in a different workspace. App audiences can view reports only if they also have Read or Build permission on the underlying dataset. When this dataset permission is not granted, the reports appear in the app but users cannot open them unless “Report level Read” access is assigned manually.

Please grant the same Entra (AAD) group that is included in your app audience Read (or Build, if required) permission on the dataset hosted in the Sales Semantic Layer workspace by performing the following steps:

1. Navigate to the dataset → Manage permissions → Add the AAD group → assign Read or Build access.
2. Republish the app after updating the permissions.
3. Test access with one user from the group to confirm resolution.

This will ensure that app users can view the reports without requiring report level or workspace access.

If the issue persists after the dataset permissions have been correctly configured, please raise a Microsoft Support ticket for a deeper investigation using the link:Microsoft Fabric Support and Status | Microsoft Fabric

We hope the information provided will help to resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.

Hi lachicazul,

Thank you for your patience.

Based on my understanding, Microsoft’s official design does not require report level Read for app users, this is necessary only when dataset permissions or app lineage fail to propagate. The configuration of Group X as an audience, with Read and Build permissions on the Sales Semantic Layer, is good, only a forced propagation is required.

1. Navigate to the SemanticModels workspace > Sales Semantic Layer > Manage permissions. Confirm that Group X has Read and Build permissions. Refresh or re-add Group X if the permissions appear stale to ensure proper propagation. Cross workspace applications depend on these dataset permissions for data access without requiring report level Read.

2. In the Sales Reporting workspace > Update app, verify that Group X is included in Audiences, then save and republish to rebuild the report–dataset links without resets. In CI/CD, use update APIs such as POST /groups/{groupId}/reports/{reportId}/Default.UpdateReportContent to preserve the report structure.

3. Ask a Group X user to install the app and open a report. The report should load fully without errors. Note any messages (for example, “access denied”) and check the Lineage view in the Reporting workspace for green checks. If Row Level Security (RLS) is enabled, ensure that users are mapped to the correct roles.

4. Grant dataset Read to Group X via the REST API POST /groups/{groupId}/datasets/{datasetId}/Default/users after completing the above steps. Avoid using report level APIs (there are none for Read/Reshare) for governance. This approach keeps the workspaces for development only and uses Apps as the consumption layer.

If the issue persists, please raise a Microsoft Support ticket for a deeper investigation using the link:Microsoft Fabric Support and Status | Microsoft Fabric

Additional reference links are provided below:
Semantic model permissions - Power BI | Microsoft Learn
The Microsoft Fabric deployment pipelines process - Microsoft Fabric | Microsoft Learn

Report level “Read” permission is neither required nor automatable by design, as no REST API exists for it. If users are unable to open reports in the App without this permission, a one time refresh of the dataset Read permission or the app lineage is required. Afterwards, report level “Read” can remain permanently removed.

We hope the information helps to resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.

Thank you.

Hi lachicazul,

We would like to follow up and see whether the details we shared have resolved your problem. If you need any more assistance, please feel free to connect with the Microsoft Fabric community.

Thank you.

Hi lachicazul,

We are following up to inquire whether you have raised the support ticket. If you have already done so, we kindly request you to share your feedback regarding the issue raised.
Please continue to use the Microsoft Fabric community for any further queries.

Thank you.