Issue with read/build permissions on Semantic Models

[eslna]

Hello folks,

I am experiencing an odd issue with semantic model permissions and I wanted to get your input. 

Here is the situation:

I have a workspace (Workspace A) with one semantic model. It has a Fabric Trial license at the moment. 

I have two users, User A and User B. Both have a Pro licenses. The semantic model does not have RLS.

I would like User A and User B to be able to find this semantic model when using the Get Data from Power BI Semantic Model option in Power BI Desktop and Excel.

I do not want to grant these users Contributor or Member roles. The only purpose of Workspace A is to contain shareable semantic models. Reports and Dashboards should be developed in other workspaces.

I read the documentation, used Copilot, and read several posts on here, and it looks like all I need to do is this:

1) Do not grant any role to User A and User B at the workspace level.

2) Access the semantic model as an admin, and explicitly grant Read and Build permissions to User A and User B.

I tried this, and yet, neither User A, nor User B can see the semantic model when searching from Power BI Desktop or Excel. 

What I tried:
1) Made sure I had the most current version of Excel/Power BI.

2) Make sure the semantic model is working by accessing it with an account that has elevated permissions. Result: This works fine. 

3) Grant User A and User B Viewer roles at the workspace level. Result: The users can see the workspace but not the semantic model. 

4) Just for funsies, I granted User A and User B Contributor roles at the workspace level. Result: The users can see the semantic model, but they can also publish reports to Workspace A. Not what I want.

Any suggestions? I feel like I am missing something simple but can't pinpoint what it is. 

-E

[tayloramy · Accepted solution]

Hi @eslna, 

That's not expected, I've never seen this behaviour before. 

I recommend opening a ticket to Microsoft. Something here is broken in your environment. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution. 

[eslna · Accepted solution]

Posting an update in case someone stumbles upon this thread with the same issue I was having:

The reason my users cannot access our models from Excel and Power BI in this scenario is because our Fabric Admins disabled "Sharing datasets across workspaces".

This setting has to be turned on, either for the whole organization, or for a security group comprised of my model users, in order for them to be able to see and connect to models.  It had nothing to do with the type of Fabric license.

[lbendlin]

Here's the correct setting

[eslna]

Changed the workspace back to Pro and I am still seeing the same issue. 

I tried a different workspace with a different semantic model just to make sure something wasn't corrupted in Workspace A, and I still see the same behavior. 

The two accounts still do not see the semantic model unless I grant them Contributor access. 

Any other suggestions?

[d_m_LNK]

What if you grant the Viewer permissions at the workspace level and build permission on the semantic model?  Apologies if you've tried that but that would avoid the contributor role but still give them visibility.

[eslna]

Hello, 

I did try this a few times but it did not work.

[Praful_Potphode]

Hi @eslna ,

Ideally what you have done should work in pro/premium capacity workspace.

user1 and User2 should have read and build on semantic model.once this is done,then they should be able to see the model.if they are not able to see the model in desktop.can you try below step:

1. ask user1/2 to go to app.powerbi.com

2. go to onelake catalog and search the model 

3. if they can see the model there then they have access

if they are still not able to see check the license type of the user(free/pro/premium) and workspace capacity(shared/premium).

if all above apaproches doesnt work, then try clearing the cache and try again.

Please give kudos or mark it as solution once confirmed.

Thanks and Regards,

Praful

[eslna]

Thanks, this is happening in Pro and Fabric Trial workspaces. I tried connecting to the semantic model from Power BI Desktop and from app.powerbi.com but the accounts have no visibility into the model.

[tayloramy]

Hi @eslna, 

I think you are running into trial limitations, but have you tried granting the users viewer on the semantic model workspace? 

 If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[eslna]

I did try that. They can see the workspace but not the semantic model.

[tayloramy]

Hi @eslna, 

Are you able to post some screenshots of what you're seeing? If a user has the viewer role, they should be able to see everything. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution. 

[eslna]

Sure!
These are the workspace roles I assigned to the two users.

These are the explicit permissions I assigned to those users at the semantic model level.

This is what they see when they browse the OneLake catalog. They are also unable to see the model from Excel, or if they navigate to that workspace.

This is a very simple model with no RLS or any additional security other than what I am trying to do here.

[tayloramy]

HI @eslna, 

Are they able to see them in the workspace itself? Is this just a problem with the onelake catalog? 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution. 

[eslna]

No, they see an empty workspace (that semantic model is the only thing there).

[tayloramy · Accepted solution]

Hi @eslna, 

That's not expected, I've never seen this behaviour before. 

I recommend opening a ticket to Microsoft. Something here is broken in your environment. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution. 

[eslna]

I am going to check a couple of things with our Fabric Admins and submit a ticket. Thank you all!

[Arul]

@eslna ,

It seems Fabric Trial workspaces won't work for this requirement. You need to move the semantic model to a normal Pro/PPU/Premium workspace and read, build will work as expected.