Allowing Power BI report updates but not semantic model updates

[markmsc]

Hello colleagues -- My team is transitioning upkeep of Power BI reports in our workspace to another team.  The reports are built on common semantic models that are created and publised to the workspace separately.  My team is keeping control of the model definitions.

The other team is receiving Contributor privileges to the workspace, which of course will allow them to edit existing reports in the service or open them in Desktop and save them back out again.  This is fine.  We also have the workspace set to disallow non-members from being able to edit semantic models in the service, which is good.  However, I am not aware of any security configuration or setting that would disallow them from saving a model to Desktop, changing it, and publishing it back out again.  I would like to prevent this if possible, but I'm thinking it is not.

Am I correct here, or is there a solution that I've overlooked or not thought of?

Thank you.

[v-pnaroju-msft]

Hi markmsc,

We wanted to see if the information we gave helped fix your problem. If you need more help, please feel free to contact the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Hi markmsc,

We are following up to see if what we shared solved your issue. If you need more support, please reach out to the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Hi markmsc,

We would like to follow up and see whether the details we shared have resolved your problem.
If you need any more assistance, please feel free to connect with the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft · Accepted solution]

Thankyou, @tayloramy, for your response.

Hi markmsc,

We appreciate your inquiry on the Microsoft Fabric Community Forum.

Based on my understanding, in the current Power BI/Fabric model, workspace roles override item level permissions. This means that if users are assigned the Contributor role in the same workspace as your semantic models, they will still be able to overwrite those models. This might be the reason you are unable to lock down models while granting Contributor rights in the same workspace.

Kindly follow the approach below, which may help resolve the issue:

1. Enable the tenant setting Block republish and disable package refresh by a Fabric/Power BI administrator, and restrict these settings to the model owner group or to a service principal. This ensures that only authorised accounts can overwrite semantic models, even when others have the Contributor role in the workspace.

We hope the information provided helps to resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric Community.

Thank you.

[tayloramy]

Hi @markmsc, 

I think you're correct 😞 

You can set permissions on the existing semantic models so they can't modify or overwrite them, but if you give them contributor permissions on the workspace I don't think you can prevent them from creating new semantic models at all. 

 I'm not aware of any way to restrict a contributor from creating an object, workspace permissions are all or nothing generally. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[markmsc]

Hi @tayloramy.  Actually, I am fine with them creating new models.  I just don't want them touching the existing production ones.  Do you know how to do as you suggest, restrict edits on existing models even though they have Contributor on the workspace?  I haven't turned up how to do that.  Thank you.

[tayloramy]

Hi @markmsc, 

I think you should be able to deny build permissions on the models. I'm not sure if contributor will overwrite that, it might. 

You could also move the models to another workspace to restrict them.  

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[markmsc]

Thanks.  I believe that you are right, Contributor will override any file-specific pernissions I could set. 

Our conversation had me considering the option of not giivng workspace permissions at all, and instead assigning them to each item in the workspace indiviually.  But that would be a pain to administer, and anyway, denying build on the models at the model level would mean the other team wouldn't be able to edit the reports that use them -- which woud defeat the purpose entirely.

Thanks again.

[tayloramy]

Hi @markmsc, 

Yeah, I don't see a good solution here. The best way to make this work the way you need is to seperate the models into a different workspace, and then only grant build permissions on them. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.