Forum Discussion
Access / Security Question
I have an unusual issue.
I've created a very simple report from my semantic model. A user on my personal tenant can access it reliably. Users on my company tenant cannot access it reliably.
Using tabular editor, they can't see any of the fact or dimension tables other than disconnected tables.
Are there any settings in teh Microsoft 365 tenant that might cause this?
Hi LiquidThinking,
Thank you for reaching out to the Microsoft fabric community forum.
It looks like the difference is mainly coming from the workspace role. When the internal user is set as Viewer, they can open and view the report, but tools like DAX Studio may not show the full semantic model structure. That is why you are only seeing disconnected tables or facing connection issues. When the same user is changed to Contributor or Member, they get higher workspace permissions and the tool can read the full model, so all fact and dimension tables become visible.Since you already confirmed that Build permission is granted and RLS is configured the same, and your external account works without issues, it does not look like a problem with the semantic model itself. It is more likely related to the permission level of the user when accessing the model through external tools. If your internal users need to inspect the model using tools like DAX Studio, they may need Contributor or Member access instead of Viewer. This would explain why it works in one role but not the other.
Kindly refer to the below documentation links for better understanding:
Build Permission for Shared Semantic Models - Power BI | Microsoft LearnHope this helps clarify the behaviour you are seeing. Let us know if you notice anything different after checking with your tenant team.
Regards,
Community support Team.
12 Replies
Hello LiquidThinking
Tabular Editor connects via XMLA to the semantic model. For that to work, yuor workspace must be on Power BI Premium capacity, and the XMLA endpoint for that capacity must be Read or Read/Write.
If your company users are B2B guests, they must switch their Active Directory context to your personal tenant i.e. that hosts the workspace/semantic model, in order to browse via XMLA.
Hello Deborshi,
I'm sorry I meant Dax Studio. When I run this I see the following behaviour:
- External account works correctly
- Internal test user account shows all data when set to Contributor/Member, and cannot connect when set to Viewer
RLS is setup identically for both accounts to enable testing.
I don't think it's an XLMA issue, something to do with the tenant not allowing RLS restrictions ?
Many Thanks,
LiquidThinkingHello LiquidThinking
DAX Studio also connects to the dataset via the XMLA endpoint. To use tools like DAX Studio or Analyze in Excel, the user must have Build permission on the dataset (Viewer alone is not enough).Grant Build at the dataset level (not workspace Contributor/Member).Power BI Service > Dataset > Manage permissionsGive access to the user(s) > Select Read + BuildEnsure they’re assigned to the appropriate RLS role(s) in the dataset: Dataset > Security > add the user(s) to the RLS role(s).
Hello LiquidThinking,
Issue: Company tenant users see only disconnected tables in Tabular Editor.
Cause: Users lack Build permission on the dataset and/or tenant sharing policies block access.
Solution:
- In Power BI Service → Dataset → Manage Permissions, add the company users.
- Grant Build permission.
- Ensure tenant sharing policies allow access.
- Verify RLS roles if applied.
After this, users can see all fact and dimension tables and access the report reliably.
References:
Thanks,
1. I'm in Fabric - when you say select Dataset is that the same as the Semantic Model?
2. I have granted Build in the Manage Permissions for the Semamtic Model - do I need to do that elsewhere as well?
3. How do I do that please?
4. The RLS works for my external account but not for internal ones, even though they are setup identically
Thanks for your assistanceHello LiquidThinking,
In Fabric, the dataset = Semantic Model, so permissions are managed the same way.
Grant Build permission via Fabric → Workspace → Semantic Model → Manage Permissions to let users see all tables in Tabular Editor.
Check RLS roles for internal users; they may need to sign out/in to refresh permissions.
After this, internal users will see all tables and have RLS applied correctly.
Grant Build Permission in Microsoft Fabric
Hi LiquidThinking,
Thank you for reaching out to the Microsoft fabric community forum.
It looks like the difference is mainly coming from the workspace role. When the internal user is set as Viewer, they can open and view the report, but tools like DAX Studio may not show the full semantic model structure. That is why you are only seeing disconnected tables or facing connection issues. When the same user is changed to Contributor or Member, they get higher workspace permissions and the tool can read the full model, so all fact and dimension tables become visible.Since you already confirmed that Build permission is granted and RLS is configured the same, and your external account works without issues, it does not look like a problem with the semantic model itself. It is more likely related to the permission level of the user when accessing the model through external tools. If your internal users need to inspect the model using tools like DAX Studio, they may need Contributor or Member access instead of Viewer. This would explain why it works in one role but not the other.
Kindly refer to the below documentation links for better understanding:
Build Permission for Shared Semantic Models - Power BI | Microsoft LearnHope this helps clarify the behaviour you are seeing. Let us know if you notice anything different after checking with your tenant team.
Regards,
Community support Team.Hi LiquidThinking,
I hope the information provided above assists you in resolving the issue. If you have any additional questions or concerns, please do not hesitate to contact us. We are here to support you and will be happy to help with any further assistance you may need.
Regards,
Community Support Team.Hi LiquidThinking,
I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We are always here to support you.
Regards,
Community Support Team.
