How Can I share the Semantic Model including Row Level Security

[scarlettgo2008]

Hi, 

Could anyone help to review and help with passing through RLS and loading data properly? 

I'm trying to create a management version on a report that we've implemented dynamic RLS based on UserRole table. 

I want to utilize the current semantic model of existing report because it's a huge dataset and I don't want to import it duplicately. 

In the original report, I do have a Main report Dataset along with 3 different RLS dataset rules as screenshot 1.  Each RLS dataset are used to filtering the rows on different columns. 

RLS Role wise I have one RLS Role which filtering on all three RLS dataset, and one Super Admin Row that does not filtering anything.  (screenshot 2 and 3)

In the new Management version, I created a new report which directly connecting to the semantic model and direct query on the Report Dataset. 

I deployed both original report and new Managment report to the same workspace, and grant testing user Read access to both report.   I added testing user to Super Admin Role in the RLS of original report so I was expecting user should be able to see all the records when they access the Management Report. 

However, when I accessing the Management Report as the testing user, I'm not able to accessing any data and get error message below: 

Error fetching data for this visual

A connection could not be made to the data source with the Name of '{"protocol":"analysis-services","address":{"server":"powerbi://api.powerbi.com/v1.0/myorg/Production%Reports","database":"Original Report"},"authentication":null,"query":null}'.

Please check the technical details for more information. If you contact support, please provide these details.

Underlying Error: QueryUserError
Activity ID: 0c88ff6c-5639-44a0-abc7-0620456669fb
Correlation ID: 801337d0-3b58-15a1-bbcb-0dde73465cc6
Request ID: 9ca15e48-919a-404f-8342-a86cbeb6206b
Time: Tue Dec 30 2025 13:55:59 GMT-0500 (Eastern Standard Time)
Service version: 13.0.27321.33
Client version: 2512.3.27315-train
Cluster URI: https://wabi-us-east2-redirect.analysis.windows.net/

Screenshot1: 

Screenshot 2& 3

[Vinodh247 · Accepted solution]

When you build a new report connected live to an existing semantic model, RLS is always enforced from the source semantic model, but access is evaluated at the dataset level, not the report level. Adding a user to a role is not enough.

What is missing in your setup i guess:

1. The testing user must have at least “Read” permission on the semantic model itself, not just the reports.
   Go to Workspace -> Semantic model -> Manage permissions -> Add user -> Read + Build (recommended).

2. RLS roles apply only when the user queries the dataset directly.
   Your “Super Admin Role” works only if:

   • The user is explicitly assigned to that role in the semantic model, and

   • The user is not blocked by missing dataset permissions.

3. The error you see is a connection/auth failure, not an RLS filter returning zero rows.
   If RLS were wrong, visuals would load with no data.
   This error means PBI cannot impersonate the user against the Analysis Services endpoint.

4. Best practice for management reports:

   • Reuse the same semantic model.

   • Grant management users Read + Build on the dataset.

   • Use a dedicated Admin role with no filters, not multiple RLS tables unless strictly needed.

   • Avoid DirectQuery to semantic-model chains unless necessary.

Grant the user permissions on the semantic model (dataset), not just the report. Once that is done, your Super Admin RLS role will work and the management report will load data correctly.

[v-hashadapu]

Hi @scarlettgo2008 , Hope you're doing okay! May we know if it worked for you, or are you still experiencing difficulties? Let us know — your feedback can really help others in the same situation.

[v-hashadapu]

Hi @scarlettgo2008 , Hope you're doing fine. Can you confirm if the problem is solved or still persists? Sharing your details will help others in the community.

[v-hashadapu · Accepted solution]

Hi @scarlettgo2008 , Thank you for reaching out to the Microsoft Community Forum.

This behavior is expected when a report is built on top of an existing semantic model that has RLS defined. RLS is enforced strictly at the semantic model level, not at the report level and it cannot be overridden or relaxed by another report. When the Management report queries the model, all RLS rules are evaluated exactly as they are defined in the source dataset.

In your case, the Super Admin role is still participating in the RLS logic through the security tables and relationships. Because those filters are evaluated at query time, the engine blocks the query instead of returning rows, which results in the “Error fetching data for this visual / QueryUserError” message. This can happen even when the user has access to the workspace and reports.

To support a management or unrestricted view, you must either create a separate semantic model without RLS or redesign the RLS so that the admin role fully bypasses all security logic. A report connected to an existing semantic model cannot weaken or bypass RLS by design.

[Vinodh247 · Accepted solution]

When you build a new report connected live to an existing semantic model, RLS is always enforced from the source semantic model, but access is evaluated at the dataset level, not the report level. Adding a user to a role is not enough.

What is missing in your setup i guess:

1. The testing user must have at least “Read” permission on the semantic model itself, not just the reports.
   Go to Workspace -> Semantic model -> Manage permissions -> Add user -> Read + Build (recommended).

2. RLS roles apply only when the user queries the dataset directly.
   Your “Super Admin Role” works only if:

   • The user is explicitly assigned to that role in the semantic model, and

   • The user is not blocked by missing dataset permissions.

3. The error you see is a connection/auth failure, not an RLS filter returning zero rows.
   If RLS were wrong, visuals would load with no data.
   This error means PBI cannot impersonate the user against the Analysis Services endpoint.

4. Best practice for management reports:

   • Reuse the same semantic model.

   • Grant management users Read + Build on the dataset.

   • Use a dedicated Admin role with no filters, not multiple RLS tables unless strictly needed.

   • Avoid DirectQuery to semantic-model chains unless necessary.

Grant the user permissions on the semantic model (dataset), not just the report. Once that is done, your Super Admin RLS role will work and the management report will load data correctly.