How to limit the access to a semantic model, or crate a filtered copy of it?

[Grieclolu]

I have published a semantic model, with many querys.
Now i would like to share with some collegues only some of the query present in this semantic model (because others are confidencial). How can i do it?

If it is not possible to directly give access only to some queries, what I had thought was to create a new power bi report, which had this semantic model as a source. at this point, select only some queries, or create new queries and at this point publish this new semantic model and share it, but I can't do it.

Can anyone help me with one of these solutions or can you propose a new solution to solve the problem?

Thanks in advance

[Grieclolu]

Hi, as i wrote, unfortunatelly i'm not able to select specific queries once i connect with the semantic model, so i still didn't soldve the problem.
See also the screenshot. Once i select the semantic model, i have no chance to open  "trasform data" or to hide one query in the right panel.

Thanks

Thanks

[v-aatheeque]

Hi @Grieclolu ,

• Since you're unable to modify specific queries directly, I recommend creating a new Power BI report based on the existing semantic model.
• You can use the "Hide" feature in Power BI Desktop to exclude sensitive queries or columns.
• Additionally, consider implementing Row-Level Security (RLS) to restrict access to specific data for different users.
• Once done, publish and share the new report with your colleagues.
  
  
  

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!

[Grieclolu]

But of course i created a new PBI report based on the existing semantic model, but again, in this new file, since the source is the semantic model, i cannot modify the queries but neither hide queries or column (see the screenshot a sent). Please if there is another way to hide query/columns, please explain me better, because in this way i'm not able to do it.

[v-aatheeque · Accepted solution]

Hi @Grieclolu 

While Power BI does not allow modifying or hiding queries/columns directly within a connected semantic model, there are alternative approaches you can take to achieve your goal :

• Use the DirectQuery and Import data combination (composite model) to have greater control over your dataset.
• Import the data you need to modify or restrict access to, and keep the rest of the data in DirectQuery mode.
• This way, you can transform and hide specific queries or columns within the imported part of the model.

Additionally you can refer this doc : https://learn.microsoft.com/en-us/power-bi/transform-model/desktop-composite-models

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!

[v-aatheeque]

Hi @Grieclolu ,

If our previous response was helpful, please consider clicking "Accept Answer" and selecting "Yes" for whether the answer was helpful. If you have any further questions or need additional assistance, please don't hesitate to reach out.

Thanks for using Microsoft Fabric Community.

[v-aatheeque]

Hi @Grieclolu ,

If our previous response was helpful, please consider clicking "Accept Answer" and selecting "Yes" for whether the answer was helpful. If you have any further questions or need additional assistance, please don't hesitate to reach out.

Thanks for using Microsoft Fabric Community.

[rohit1991]

Hi  @Grieclolu ,

This is a common scenario with Power BI semantic models. Unfortunately, there isn’t a way to share just part of a semantic model (specific queries/tables/measures)  access is all or nothing. If someone has build access to the dataset, they can see everything inside it, regardless of what’s hidden in the report view.

Here’s what you can do: 

1. Create a new, trimmed-down dataset: Open Power BI Desktop and connect to your published semantic model (Home > Get Data > Power BI datasets). Bring in only the tables or columns you want others to access. Publish this new dataset to the Power BI Service, and share it with your colleagues. Now, they’ll only have access to what you included in this new model.
   
   

2. If you only want to restrict data rows (not tables/columns), use Row-Level Security (RLS): RLS can limit which data a user sees, but not hide entire tables or queries.
   
   

3. If your data is in a database, you can create a view with only the safe data and build a new model on that.
   
   

Power BI doesn’t support “partial sharing” of semantic models. The only supported way is to publish a separate dataset containing just what you want to share.

[Grieclolu]

For the point 2) instead, it seems to be a good solution also, but i can't "select only the required queries"; In fact, when i connect the existing semantic model in Power BI Desktop, it directly connects to all the queries and doesn't give me the chance to select (or hide) the specific queries.

Thanks

[Grieclolu]

Gi,

Thanks for your reply. About 1) i don't think it is the solution, because RLS define limitations by role, while my need is to limit 'entire tables (queries) and/or specific columns.
Example, in my semantic model i have 3 querys: sales 21, sales 22, sales 23. I want to give to a specific person only the visibility to the sales 21 (so limit him on sales 22 and 23); moreover, i want to hide some columns of the sales 22 query.
However, if is it the correct way, can you also explain my where to manage the role in the semantic model? Because i only see the "Manage security roles" in Power BI Desktop. If I set roles are they also applied to the semantic model?

Thank you in advance

[v-aatheeque]

Hi @Grieclolu ,

Thanks for reaching out to the Microsoft Fabric Community forum.Apologies for the issue you are facing.
Here are a few things you could check :

• Create separate datasets for each query (e.g., sales 21, sales 22, sales 23) and publish them individually. This way, you can control access to each dataset separately.
• To restrict access to entire tables (like your sales 22 and sales 23), you can create separate datasets for each table or query. For example, you could create a dataset that only includes the sales 21 data for the specific user. This way, when the user accesses the report, they will only see the data they are allowed to see.
• To hide specific columns in a table, you can use the "Hide" feature in Power BI Desktop. Power BI Desktop>> model >> Table >>Right click on the column that you want to hide.
• To manage roles in Power BI Desktop:Go to Home>> Manage Roles.Create a new role and define the DAX filters for the tables you want to restrict.
• When you publish the report to the Power BI Service, the roles you set up in Power BI Desktop will be applied to the dataset in the service. However, remember that RLS only restricts access to rows, not entire tables or columns.

Additionally, you can refer this link related to RLS roles : DAX USERPRINCIPALNAME - Use in RLS - Power BI Docs

And for how rls sample model , you can refer to :
Dynamic Row Level Security with Power BI Made Simple - RADACAD

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!

[Grieclolu]

Hi,

Thank you very much for your explanation. However, this solution doen't seems to fit to me. In fact, i have a unic semantic model with many queries; create a dataset for each query seems to be a very long procedure. Is not any other solution? Like connect a new model in power bi desktop to the existing semantic model, pic only some query from a semantic model, an then publish it again as new semantic model (connected with the master). 
My goal is to give another user access to the data in the semantic model, but only to some tables (and/or columns), so that he can see/work only on specific data, while I have access to everything from the original model.

I hope i have been clear. Thank you in advance.

[v-aatheeque]

Hi @Grieclolu ,
Based on the above query :

• Go to Home > Get Data > Power BI datasets. Select your existing semantic model from the list of available datasets.
• Once connected, you can choose which tables (queries) to include in your new model. You can exclude the tables you do not want the user to access (e.g., "sales 22" and "sales 23").
• you can hide specific columns that you do not want the user to see. Right-click on the column in the model view and select Hide in Report View.
• After configuring the new model, publish it to the Power BI Service. This will create a new dataset that only contains the selected tables and columns.
• Go to Datasets and click on Manage Permissions. Add the specific user and assign the appropriate permissions
• Similarly, go to Reports and manage the permissions to ensure that the specific user has access to view the report based on the new model.

Additional you can refer the below doc 's :
Share access to a semantic model - Power BI | Microsoft Learn
Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance.

[Grieclolu]

Hi, this is exactly what i was looking for, but unfortunatelly once i select the semantic model, i don't have any chance to select the single query. I just get the entire semantic model without the possibile to select (ore exlude) the single query. Can you pleae help me on this specific point? 

[v-aatheeque]

Hi @Grieclolu ,

If @rohit1991 s response helped you resolve your issue, please consider marking it as the accepted answer. If you found this information helpful, I would greatly appreciate your kudos. Thank you!

If you still encounter any issues, don’t hesitate to reach out for further assistance!