Visuals Not Working when using Direct Access Queries

When a report connects to an upstream semantic model via live connection, Power BI evaluates the viewing user's own identity against the upstream model directly. Your service account OAuth2 credentials are irrelevant for this connection type, which is why users need both Read permission and RLS access on the upstream model regardless of how the downstream report is configured. Adding Entra ID security groups directly to RLS roles in the upstream semantic model is fully supported and is the correct scalable solution: add the group to the RLS role via the upstream model's Security settings, grant the group Read permission on the model, and then manage all user access by adding or removing members from the Entra group in Entra ID admin without ever touching Power BI again.