Power BI App Allowing Share Access to Semantic Model

[YeahMan]

Hi Community

I have created a PBI app with 2 reports, reportA and reportB. ReportA is behaving as expected, but reportB has some access issues. In particular, the audience members can share the underlying semantic model. Below are some screenshots to assist:

Report settings:

Semantic Model Permissions:

When the Heather selects the ellipses > View semantic model:

She sees the following:

which allows her to share the semantic model. ReportB has the identical settings as above, but the option to share the semantic model is missing.

A second thing that is happening, which seems odd to me, is that when I remove Heather from the audience her permissions on the semantic model change from App to Read. Before adding her to the audience, she had no access to the model. Once I add her back in, the permissions change back to App. I would think once she is removed from the audience her access to the model should be completely removed??

Any assistance you can provide would be greatly appreciated!

Thanks, Sue

[v-tsaipranay]

Hi @YeahMan ,

I wanted to follow up on our previous suggestions. We would like to hear back from you to ensure we can assist you further. Please let us know if there’s anything else we can do to help.

Thank you.

[v-tsaipranay]

Hi @YeahMan ,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[v-tsaipranay]

Hi @YeahMan ,

Thank you for reaching out to the Microsoft Fabric Community. Also thank you @Watsky  for your valuable suggestions.

Since Report A is functioning as expected within the app, and only Report B is exhibiting unexpected sharing behavior, it’s reasonable to investigate Report B’s specific setup. One possibility is that Report B might be connected to a different semantic model or dataset even if it appears similar.

We recommend going to the Power BI Service and checking the “Manage Permissions” on the dataset used by Report B to ensure that no direct or legacy access has been granted to the user. Also, double-check that Heather doesn’t have any residual access through workspace roles, even temporarily, as that can sometimes persist unexpectedly.

Additionally, if Report B was published or updated at a different time than Report A, it may be carrying different metadata or permissions especially if the app was not re-published after changes. As a next step, you might try republishing Report B and re-adding it to the app, ensuring that audience permissions are fully aligned in the app’s advanced settings.

Hope this helps. Please reach out for further assistance.

If this post helps, then please consider to Accept as the solution to help the other members find it more quickly and a kudos would be appreciated.

Thank you.

[YeahMan]

Thanks @v-tsaipranay ,

We:

• removed reportB from the app,
• republished the app,
• downloaded the reportB,
• saved and reuploaded it with no changes,
• added reportB back in, and
• now it works. 

My recommendations for using Apps are as follows:

1. Create a new workspace
2. Download the reports to be included
3. Open/save in Desktop
4. Publish to new workspace (gives you a fresh copy of the semanitic model)
5. Create app for the new workspace
6. Add in the reports

Other than Workspace Admins, all audience members should have App permissions only.

[v-tsaipranay · Accepted solution]

Hi @YeahMan ,

Thank you for confirming that removing Report B, republishing the app, uploading a new copy, and re-adding it resolved the extra Share semantic model option. This reset created a new semantic model without leftover permissions.

For future updates, use a clean workspace, publish new copies of each report, and keep viewers on App-only access. Also, check the Audience › Advanced settings and Manage Permissions after each update; tenant-level or model-level “Build” restrictions can provide additional security if needed.

Please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[Watsky]

Hi @YeahMan,

When you click Update App and navigate to the Audience section, there is an advanced section. Are the options checked there?

Also, did you check to see if Heather is a member of one of the groups that has read access?

Did my answer(s) help you? Give it a kudos by clicking the Thumbs Up! ?
Did my post answer your question(s)? Mark my post as a solution. This will help others find the solution.

[YeahMan]

Hi @Watsky Thanks for responding. The options are not selected under the advanced section and Heather is not a member of any of the groups with Read access to the model or the report. Thanks for the Groups suggestion - I hadn't thought of checking that one.

[Watsky]

I really think that Heather is part of group that has the access. I just ran a test where I have a service account that does not have access to a specific workspace, but gave it access to an App.

When I go to load the semantic model I am getting this error:

Then I added a security group that the has the service account in it. 

Now, the service account has access to Share.

App only access does not grant access to view the semantic model. You have have at least Contributor access and App is only view access. So, if Heather can see the Semantic page then she has more than just App access some where.

If you can, have Heather on a call and change the permissions of the groups to viewer and have her try and see if any are changing her permissions.  

Did my answer(s) help you? Give it a kudos by clicking the Thumbs Up! ?
Did my post answer your question(s)? Mark my post as a solution. This will help others find the solution.

[YeahMan]

Hi,

As near as we can tell she doesn't belong to any groups, but we'll keep digging. Thanks for everything so far. 

Because reportA is behaving the way it should in the app, could there be something in the report settings on reportB either in service or desktop that could be mucking us up?