Forum Discussion
Community ChampionEnd users' permissions on semantic model
Community Champion"For example, when you share a report, you also share access to the semantic model below. You need to define security on the semantic model using Row Level Security (RLS) or Object Level Security (OLS) to prevent a report consumer from accessing all the data in the semantic model. By default, the read access of a report consumer isn't restricted to the elements and data they see in the report (...)"
Quote from the docs.
So I understand that when we share a report to a consumer, i.e. Read permission, we share access to the underlying semantic model.
As an example, think of Copilot, which enables users to easily access data which is not visible in the report. https://learn.microsoft.com/en-us/power-bi/create-reports/copilot-ask-data-question
There are also other, existing ways for the users to access data which is not visible in the report.
So I am wondering which parts of a Power BI semantic model is theoretically available to a user with Read access? Only the data, or metadata like table and column names, measure names, relationships, roles? What about DAX code? What about M code?
Ref. the bullet points in my original post.
- Tutu_in_YYC
Super User
My earlier reply contains responds to your bullet points.
Re what Copilot reads, i can only assume it is based on what it is being asked to do and based on data that is available to the user ie data that is protected by OLS/RLS should not be included. But there are already reports about Copilot going around RLS
https://community.fabric.microsoft.com/t5/Service/Using-Copilot-to-circumvent-Row-Level-Security/td-p/3987022
Solution to the above issue has been delivered
https://community.fabric.microsoft.com/t5/Issues/Copilot-answering-data-questions-outside-of-Row-Level-Security/idi-p/3987276- frithjof_v
Thank you Tutu_in_YYC ,
I appreciate your responses and the information you shared!
It's also interesting to read that a user reported that Copilot preview didn't respect RLS settings. If what the user says is real, then I am both surprised and concerned about that. However I can't know if that user had set up the RLS properly.
I appreciate your responses, still as you say:
"These responds are based on testing and experience, but may not be 100% accurate as PBI changes all the time, exceptions exist, new tools appears, and new mode like direct lake provides a different set of management tools. Also, i could be wrong too..
If you see anything that may be outdated, incorrect or something that needs confirmation/context, let me know and we can try to update information."
I want to know what is the theoretical boundaries of the Read role. This way, I can be confident that no new features or changes in Power BI software will expose unintended data/metadata to the end users.
Because I want to know if for example Copilot (or API queries, etc.) can give the end users access to DAX code or M code or RLS roles names in my semantic model. Does the end user theoretically have permission to read the comments in my DAX code / M code?
I want to know the specific implications of "when you share a report, you also share access to the semantic model below" (quote from the docs). Which parts of the semantic model does it refer to? All of it? Or only the data content + table/column/measure names + relationships, for example?
