Help with Explore This Data for Read-only

[AC23VM]

As with a few other people, I've got issues with Read-only permissions able to 'Explore this data' in the semantic model when they shouldn't be able to. 

Under the report permissions, none of the viewers have build access, and all are Read-only:

This is also true when looking at the semantic model permissions:

Copilot also suggested I turn off this setting in the semantic model, but it hasn't changed anything:

I've seen this solution, but it doesn't say where or how to do this, beyond what I've already done in setting the link as Read when people request access:

You can assign the user the Viewer workspace role or read access to the semantic model.
The "Explore this data" option will then be disabled for that user.

Any ideas how I can stop Read-only viewers from accessing Explore this data, or if I'm looking in the wrong place for build permission?

[rohit1991]

Hii @AC23VM 

In Power BI, “Explore this data” is disabled for read-only users by design. Even if users have Read access to the report and the semantic model, the Explore this data option only appears when a user has Build permission on the semantic model. Read access allows viewing and interacting with visuals, but exploring underlying data requires Build rights. To enable it, grant users Build permission on the dataset (Semantic model >> Manage permissions) or add them as Contributor/Member to the workspace; otherwise, it cannot work in read-only mode.

[AC23VM]

Right, but that's exactly what isn't happening.  So, presumably I'm looking in the wrong place, and they do have build access I somehow can't see.  That's my entire question.

[v-hashadapu · Accepted solution]

Hi @AC23VM , Thank you for reaching out to the Microsoft Community Forum.

Explore this data is no longer controlled only by Build. If the semantic model setting “Allow users with view permission on a semantic model to launch Explore” is enabled, then users with Read access can still open Explore this data, even when the report link is Read only and they are only Viewers in the workspace. That access does not appear anywhere as Build, which is why it is confusing.

If you want to stop Read only users from accessing Explore this data, you must disable that Explore setting on the semantic model itself and apply the change. Report permissions, sharing links and workspace roles will not override it. Once the setting is turned off, only users with explicit Build permission will see Explore this data, which restores the behaviour you were expecting.

[AC23VM]

Thanks.  I'd already applied this setting, but of course I couldn't see it in effect!  Checked it with someone who has read-only access, and it works.