Forum Discussion
Resolver IIHow to implement read access to a report that is based on a semantic model with DirectLake Lakehouse
Thank you! I actually could solve my use-case: I learned that a user has to have the ReadAll role on the Lakehouse, Read on the semantic model and Read on the report. Further, RLS can be activated on the semantic model and it works fine (though I am not sure if there is a fallback to DirectQuery, maybe someone has the details here). And because the user has no View-rights on the workspace, the user also cannot access the Lakehouse directly, which is what I wanted.
Hi JayJay11 ,
In your description, you want the user to have read access to reports derived from the semantic model, but not direct access to the semantic model or Lakehouse. you may run into problems because of the way permissions are managed in the workspace.
Make sure that you have assigned the Viewer role to the user in the workspace. This role allows users to query data from SQL or Power BI reports, but not to create items or write to data. This step ensures that users can access reports in the workspace without having broader access rights. For more details on workspace roles, read the following link:
Roles in workspaces in Power BI - Power BI | Microsoft Learn
Get started securing your data in OneLake - Microsoft Fabric | Microsoft Learn
When a user interacts with a report, RLS only works for the Viewer in the workspace. For more information on implementing RLS:
Row-level security (RLS) with Power BI - Power BI | Microsoft Learn
Best Regards,
Ada Wang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Resolver IIThank you! I actually could solve my use-case: I learned that a user has to have the ReadAll role on the Lakehouse, Read on the semantic model and Read on the report. Further, RLS can be activated on the semantic model and it works fine (though I am not sure if there is a fallback to DirectQuery, maybe someone has the details here). And because the user has no View-rights on the workspace, the user also cannot access the Lakehouse directly, which is what I wanted.