Error message when using Direct Query

[hdemedici100]

When using Direct Query, do users need access to the source semantic model?

Above is a screenshot of the model I'm working with. The source data is the model in red. I have used this to then create my own semantic models, and reports from them.

The reason for this is because we don't want users to see the full report (in red), so we've used RLS. Additionally, we also wanted to change the way the data was presented to the report consumers.

However, when doing this, the users who don't have access to the source report (which is the majority) are receiving the following error message:

Could anyone advise what would be an apropriate solution please?

Thanks!

[TomMartens]

Hey @hdemedici100 ,

yes, I'm referring to the 'Microsoft 365 Usage Reports' model, there is no need to import the model, you can transform the live connection to direct query model: https://learn.microsoft.com/en-us/power-bi/connect-data/desktop-directquery-about when creating the models "M365 Copilot" and "M365 Copilot detail".

Regards,

Tom

[hdemedici100]

Hi @TomMartens,

So the connection is already a DirectQuery connection:

In this circumstance, I really need to avoid giving the report consumers access to the 'Microsoft 365 Usage Reports' semantic report.

I've noticed in the semantic report settings for 'M365 Copilot' and 'M365 Copilot detail' lets you choose which 'Connection' to use to access the source semantic model (Microsoft 365 Usage Reports). I've been trying to play around with this to see if this can do anything, I've also been using this guidance: Add or remove a gateway data source - Power BI | Microsoft Learn, but I still haven't got anywhere yet.

Here is the configuration I've been trying to play around with:

The bottom one is the connection to the source semantic model (Microsoft 365 Usage Reports). I've tried the different configuration options, but have not had any luck yet. 

Would welcome any further advice. Thank you!

[Anonymous · Accepted solution]

Hi @hdemedici100 ,

You could explor the possibility of setting up a service principal or a dedicated gateway with specific credentials that can access the underlying data but does not expose it to the end users. This setup would allow automatic data refresh while maintaining the security and restrictions needed.

Best regards,

Lucy Chen

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[TomMartens]

Hey @hdemedici100 ,

Users need access rights to the underlying semantic model. I recommend that you create an Entra ID group, add all semantic model users to it, and give this group read permission ("mange permissions").

Do not forget that providing read permissions to the semantic model differs entirely from configuring RLS.

Permission determines who has access, and RLS determines what data can be seen by those users.

Regards,

Tom

[hdemedici100]

Hi @TomMartens,

When you say underlaying semantic model, I'm assuming you're referring to the 'Microsoft 365 Usage Reports' in my case? Is there no way for me to use a different set of credentials in Power BI Service?

I don't want to the consumers of this report to have access to the 'Microsoft 365 Usage Reports', just the two semantic models and reportd I've created. Partly because I'm using RLS, and partly because I've created the relevant visuals which the report consumers would need to see.

Do you (or anyone) know if there is any way around this? I'd like to avoid using import in this circumstanece as I need the data to be refreshed automatically on a regular basis.