How to audit RLS (DMVs) via XMLA in Fabric/Power BI without being the "Dataset Owner"?

Hi everyone,

I am building a centralized audit tool in Microsoft Fabric to extract RLS configurations (Roles, Members, and DAX Filter Expressions) across multiple workspaces. My goal is to create a script that any authorized Auditor or Workspace Admin can run, regardless of who originally created the model.

The Problem: I am using a Python Notebook with the sempy.fabric library. The script works perfectly if I am the Owner of the semantic model. However, if I am a Workspace Administrator but NOT the original creator/owner, the engine blocks the metadata read.

import sempy.fabric as fabric
import pandas as pd

workspace_id = "..."
# I am a Workspace Admin, but a colleague created this model
modelo_nombre = "..."

try:
# Querying the DMVs for Roles, Memberships and Table Permissions
df_roles = fabric.evaluate_dax(modelo_nombre, "SELECT * FROM $SYSTEM.TMSCHEMA_ROLES", workspace=workspace_id)
df_usuarios = fabric.evaluate_dax(modelo_nombre, "SELECT * FROM $SYSTEM.TMSCHEMA_ROLE_MEMBERSHIPS", workspace=workspace_id)
df_reglas = fabric.evaluate_dax(modelo_nombre, "SELECT * FROM $SYSTEM.TMSCHEMA_TABLE_PERMISSIONS", workspace=workspace_id)

print("Extraction successful")
except Exception as e:
print(f"Error: {e}")

The Error: AdomdErrorResponseException: User '<my_email>' needs to be an administrator to read the metadata of the database '6b4e132c-...'

Technical Details:

• Environment: Fabric F64 Capacity.

• Permissions: I have Admin role in the workspace and Build permissions on the dataset.

• XMLA Endpoint: Enabled (Read Write).

• Crucial Observation: When the Original Creator runs this exact code, it works. When I (Admin) run it, it fails with the "needs to be an administrator" error.

What I need to know:

1. Why does the Analysis Services engine require "Ownership" or fail to recognize the Workspace Admin role for DMV queries via XMLA?

2. Is there a way to allow non-owners (but Admins) to read these system tables?

3. Would using a Service Principal bypass this "Owner" requirement?

I need a solution that doesn't require me to "Take Over" every model, as that would break existing scheduled refreshes and credentials.

Thanks in advance!