Forum Discussion
Power BI Semantic models access setup
Hello, Need help with the access setup. here is the situation. I have a parent semantic model and a child model built on top of it. both models are residing in a workspace. I have a dashboard built using child semantic model residing in a reports specific workspace. there are set of users who only need to access the child model and the dashboard and they should not see or access the parent model. Right now, In power BI, it is forcing me to give at least Read and Build access to parent model for those users, which in turn allowing them to see the parent model and build reports using it. How do I restrict this? So just to recap, the requirement is that for these set of users, I want them to use only Child model and build/modify reports on it but not have access to Parent model.
We are using the Power BI Pro workspaces.
Any help with thi sis appreciated.
Thanks
Mahesh
Not possible to restrict that unless you want to go the "Import from Analysis Services" route that would extract the data from the "parent" model (while breaking RLS and measures etc).
Hi Anonymous , Thank you for reaching out to the Microsoft Fabric Community Forum.
lbendlin is correct. In Power BI, when you build a child semantic model (dataset) on top of a parent semantic model using DirectQuery for Power BI datasets, every user who needs to query the child must also have Build permission on the parent dataset. This is a fundamental design requirement of the feature, the queries are executed in the context of the parent model, so Power BI must ensure those users are authorized to query it.
Because of that, it’s not possible in Power BI Pro to let users access only the child model and hide the parent model. The only way to fully isolate access is to break the live dependency, for example by importing data from the parent model into the child model (which disables dynamic updates, RLS inheritance and shared measures). There’s no configuration of workspace roles or RLS that can bypass this limitation.
Build Permission for Shared Semantic Models - Power BI | Microsoft Learn
Use composite models in Power BI Desktop - Power BI | Microsoft Learn
6 Replies
Not possible to restrict that unless you want to go the "Import from Analysis Services" route that would extract the data from the "parent" model (while breaking RLS and measures etc).
Hi Anonymous,
The simplest solution (with notes)
Step 1: Workspace Setup
- Keep both semantic models in the same workspace
Step 2: Permission Configuration
- Parent model: Give users "Read" permission only
- Child model: Give users "Read and Build" permission
- Workspace: Add users as Members
Step 3: RLS on Parent Model
Create RLS role on parent model with very restrictive rules:
-- Example (Only allow specific admin users) IF(USERPRINCIPALNAME() IN {"[email protected]"}, TRUE(), FALSE())Step 4: User Guidance
- Train users to only use the child model
- Do not share parent model links
- Monitor usage to ensure compliance
Step 5: Test It
Notes:
- Users can see the parent model exists in the workspace list
- Parent model appears in "Recent" and "Search" results for users
- potential user confusion...users might accidentally try to use the wrong model
- Complex RLS setup required on the parent model
- User training needed to explain which model to use
- users technically have "Read" permission
- harder to track actual vs. intended access
- Documentation complexity for security policies
But on the other side this is the most reliable solution for your case ☺️
if this post helps, then I would appreciate a thumbs up and mark it as the solution to help the other members find it more quickly.Hi Anonymous , Thank you for reaching out to the Microsoft Fabric Community Forum.
lbendlin is correct. In Power BI, when you build a child semantic model (dataset) on top of a parent semantic model using DirectQuery for Power BI datasets, every user who needs to query the child must also have Build permission on the parent dataset. This is a fundamental design requirement of the feature, the queries are executed in the context of the parent model, so Power BI must ensure those users are authorized to query it.
Because of that, it’s not possible in Power BI Pro to let users access only the child model and hide the parent model. The only way to fully isolate access is to break the live dependency, for example by importing data from the parent model into the child model (which disables dynamic updates, RLS inheritance and shared measures). There’s no configuration of workspace roles or RLS that can bypass this limitation.
Build Permission for Shared Semantic Models - Power BI | Microsoft Learn
Use composite models in Power BI Desktop - Power BI | Microsoft Learn
Hi Anonymous , Hope you're doing okay! May we know if it worked for you, or are you still experiencing difficulties? Let us know — your feedback can really help others in the same situation.
Hi Anonymous , Hope you are doing well. Kindly let us know if the issue has been resolved or if further assistance is needed. Your input could be helpful to others in the community.
Hi Anonymous,
Just wanted to follow up and confirm that everything has been going well on this. Please let me know if there’s anything from our end.
Please feel free to reach out Microsoft fabric community forum.Thank you.
