CI/CD: Automating semantic model security (RLS/OLS role members)

[FrederikAage]

I am working on automating CI/CD for semantic models in Power BI / Fabric.

I can successfully deploy semantic models and define RLS/OLS roles using TMDL, but I am unable to automate the assignment of users or Azure AD groups to those roles.

At the moment, role membership must be added manually through the semantic model security UI.

Is there any supported way to automate role membership for RLS/OLS, for example via:
- Power BI REST API
- XMLA endpoint / TOM
- Fabric REST APIs

My goal is a fully automated, repeatable deployment without manual post-deployment steps.

[Mauro89 · Accepted solution]

Hi @FrederikAage, 

currently there is no out of the box and automated solution for that in Fabric.

Check out the following post not too long ago which might help you out with a third party tool:

Solved: How to migrate RLS roles assignment between datase... - Microsoft Fabric Community

Best regards!

PS: If you find this post helpful consider leaving kudos or mark it as solution

[v-nmadadi-msft]

Hi @FrederikAage 

May I check if this issue has been resolved? If not, Please feel free to contact us if you have any further questions.

Thank you

[v-nmadadi-msft]

Hi @FrederikAage 

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.

Thank you.

[v-nmadadi-msft · Accepted solution]

Hi @FrederikAage ,
Thanks for reaching out to the Microsoft Fabric Community forum.

Another approach other than the valuable one suggested by @Mauro89 for assigning Row-Level Security (RLS) membership in Power BI is to use Microsoft Entra security groups. RLS roles are defined in Power BI Desktop and published to the Power BI Service, after which Entra ID security groups are assigned to those roles as a one time configuration.

Source: Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn

Please follow this article on how to automate creating security groups:
Configure group settings using PowerShell - Microsoft Entra ID | Microsoft Learn

I hope this information helps. Please do let us know if you have any further queries.
Thank you

[Mauro89 · Accepted solution]

Hi @FrederikAage, 

currently there is no out of the box and automated solution for that in Fabric.

Check out the following post not too long ago which might help you out with a third party tool:

Solved: How to migrate RLS roles assignment between datase... - Microsoft Fabric Community

Best regards!

PS: If you find this post helpful consider leaving kudos or mark it as solution