How Can I share the Semantic Model including Row Level Security

When you build a new report connected live to an existing semantic model, RLS is always enforced from the source semantic model, but access is evaluated at the dataset level, not the report level. Adding a user to a role is not enough.

What is missing in your setup i guess:

1. The testing user must have at least “Read” permission on the semantic model itself, not just the reports.
   Go to Workspace -> Semantic model -> Manage permissions -> Add user -> Read + Build (recommended).

2. RLS roles apply only when the user queries the dataset directly.
   Your “Super Admin Role” works only if:

   • The user is explicitly assigned to that role in the semantic model, and

   • The user is not blocked by missing dataset permissions.

3. The error you see is a connection/auth failure, not an RLS filter returning zero rows.
   If RLS were wrong, visuals would load with no data.
   This error means PBI cannot impersonate the user against the Analysis Services endpoint.

4. Best practice for management reports:

   • Reuse the same semantic model.

   • Grant management users Read + Build on the dataset.

   • Use a dedicated Admin role with no filters, not multiple RLS tables unless strictly needed.

   • Avoid DirectQuery to semantic-model chains unless necessary.

Grant the user permissions on the semantic model (dataset), not just the report. Once that is done, your Super Admin RLS role will work and the management report will load data correctly.

Hi scarlettgo2008 , Thank you for reaching out to the Microsoft Community Forum.

This behavior is expected when a report is built on top of an existing semantic model that has RLS defined. RLS is enforced strictly at the semantic model level, not at the report level and it cannot be overridden or relaxed by another report. When the Management report queries the model, all RLS rules are evaluated exactly as they are defined in the source dataset.

In your case, the Super Admin role is still participating in the RLS logic through the security tables and relationships. Because those filters are evaluated at query time, the engine blocks the query instead of returning rows, which results in the “Error fetching data for this visual / QueryUserError” message. This can happen even when the user has access to the workspace and reports.

To support a management or unrestricted view, you must either create a separate semantic model without RLS or redesign the RLS so that the admin role fully bypasses all security logic. A report connected to an existing semantic model cannot weaken or bypass RLS by design.