Apply Data Restrictions for building reports on Semantic Model

[Prajit0710]

Problem Statement:

We have implemented a dynamic Row-Level Security (RLS) solution in our semantic model to restrict data access for viewing.

Current Challenge:

Some users want to build reports on our semantic model. However, when we provide them with contributor access, they gain access to the entire dataset, bypassing the RLS restrictions.

Required Solution:

Is there a way to allow users to build reports while still enforcing RLS data restrictions on the semantic model?

[v-ssriganesh]

Hi @Prajit0710,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[v-ssriganesh · Accepted solution]

Hi @Prajit0710,
Thank you for reaching out to the Microsoft fabric community forum.

Also, a big thank you to @Akash_Varuna and @Deku for their valuable insights. To summarize and provide the best governance approach, here’s the recommended solution to allow users to develop reports while ensuring RLS is applied:

Use a Separate Report Workspace.

• Keep the Semantic Model in a Secured Workspace by applying RLS to restrict data access and assigning the Viewer role to report builders in this workspace to ensure RLS is enforced.
• Create a Separate Workspace for Reports by assigning Member or Contributor roles to users in this workspace (not in the model workspace) so they can connect to the semantic model while still being restricted by RLS.
• Grant "Build" Permission on the Dataset so that users with Viewer and Build permissions can create reports without bypassing RLS and connect via Power BI Desktop (Live Connection) or Power BI Service to build reports securely.
  
  

If this information is helpful, please Accept it as a solution and give a "kudos" to assist other community members in resolving similar issues more efficiently.

Thank you.

[Prajit0710]

Thank you everyone for helping.

This solution works perfectly.
It took time to validate the solution as we have tested with multiple users.

[Deku]

Give build permissions on the semantic model to the users

[Akash_Varuna]

Hi @Prajit0710 To do this publish the semantic model with RLS applied and then publish to Power BI Service. Assign users Viewer access instead of Contributor, ensuring they use the dataset for reporting while adhering to RLS restrictions. Alternatively, create a Power BI App with the dataset and share it with Viewer permissions.

[Prajit0710]

Hi Akash_Varuna, We have implemented the solution which you have mentioned above. The users are able to see the data with RLS restrictions in the app. But is there a way to develop reports with the data restrictions applied.

We have developed a model which is the generalized solution in our org which other teams are able consume with RLS applied. But the consumers want to develop reports that fit their specific requirement on top of our semantic model. 

With RLS and viewer permissions, we can only have Analyse in excel. Is there any way by which we can build reports with data restrictions applied?

Preview