Forum Discussion
Generate Ontology from Semantic Model - Security
Super UserHey HoucemDerbelItm ,
Great question and an important one to ask early. Security assumptions like this one are easy to inherit silently, so raising it before relying on the ontology is exactly the right move.
RLS roles and DAX rules you define in a semantic model do not carry over to an ontology generated from it, so there is a genuine data‑leak risk. Semantic‑model RLS is only enforced when data is queried through the model (Power BI reports, Analyze in Excel, DAX). Ontology generation borrows the model's structure (entity types, properties, relationships) but binds to the underlying OneLake tables directly, reading beneath the layer where RLS lives which is why bound‑data queries work without measures or calculated columns.
Worse, ontology data binding currently requires the bound tables to have OneLake security disabled, so you can not push RLS down to OneLake either. Access to ontology data is therefore governed only by item‑level permissions, not row‑level and that same all‑rows access flows to downstream graph QuerySets and agents.
So do not treat semantic‑model RLS as a security boundary for an ontology. If some users may only see part of the data, separate it structurally (bind only the entitled subset, or use per‑audience ontologies/workspaces) and control access at the item level. And since this is a preview feature, keep sensitive or regulated data out of generated ontologies until per‑user row security is supported.
For Detailed Information: