Model Build Permissions AND Viewer Workspace Permissions to Create Report?

[arock-well]

On Fabric F64 SKU, does a user need not only Build permissions to a semantic model but also Viewer permissions in the workspace the model resides?

We're trying to figure this out, but giving only Build permissions doesn't appear to allow the user to connect to the model when in Power BI Desktop. I was hoping they didn't see the workspace in the Power BI Service, but just access to the model only.

[v-achippa]

Hi @arock-well,

Thank you for reaching out to Microsoft Fabric Community.

Thank you @rohit1991, @Deku and @ArwaAldoud for the prompt response.

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by the super user resolved your issue? or let us know if you need any further assistance.
If our super user response resolved your issue, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

Thanks and regards,

Anjan Kumar Chippa

[arock-well]

After further testing, it seems that applying Viewer permissions still does not allow connections to models.

However, if I grant Contributor permissions, it appears this does allow for that. This link has some footnotes that explain this: Roles in workspaces in Power BI - Power BI | Microsoft Learn

However, footnote 10 says this:

10 Consuming data from a dataflow gen2 with the dataflow connector requieres Admin, Member or Contributor permissions. Viewer permissions is not sufficient and is not supported for consuming data from the dataflow gen2.

The problem with this is all my dataflows are Gen1, so this footnote is apparently wrong.

In any case, granting users Contributor roles is allowing them to have more permissions to a Workspace than we want to allow, such as being able to delete content in the Workspace.

I'm hoping that Microsoft can modify or add a role to simply only allow users to connect to semantic models and that's it.

[rohit1991]

Hi @arock-well,

Yes, on Fabric F64 SKU, a user typically needs both Build permissions on the semantic model and at least Viewer permissions in the workspace where the model resides to connect to it in Power BI Desktop. While Build permissions allow users to create reports based on the model, Viewer permissions in the workspace ensure visibility and access to the model within Power BI Service. 

Without Viewer permissions, users may struggle to connect to the model from Power BI Desktop, as workspace security settings can restrict access. Unfortunately, this also means they will see the workspace in Power BI Service, even if you only want them to interact with the dataset. A potential workaround is using shared datasets from a separate workspace to control visibility while ensuring proper access.

[Deku]

Build only, viewer would stop build from applying 

[ArwaAldoud · Accepted solution]

Hi @arock-well 
Yes, in most practical scenarios, especially when using Power BI Desktop, a user will likely need both Build permissions on the semantic model and Viewer permissions on the workspace to effectively create reports.

- Build permission only (No Viewer access) → The user might not see the model in Power BI Desktop.
- Viewer access only (No Build permission) → The user can view reports but cannot create new ones from the model.
- Want access to the model without exposing the workspace? → Consider using Shared Dataset Access from another workspace.

If this response was helpful, please accept it as a solution and give kudos to support other community members

[arock-well]

None of these links appear to indicate someone must have Viewer permissions to a Workspace to be able to connect to a model, which is what we want. We don't want or need someone to view the workspace contents, just be able to connect to a model in Power BI Desktop with Build permissions set on the model. It's very confusing.

https://learn.microsoft.com/en-us/power-bi/connect-data/service-datasets-permissions

https://learn.microsoft.com/en-us/power-bi/connect-data/service-datasets-manage-access-permissions

https://learn.microsoft.com/en-us/power-bi/connect-data/service-datasets-build-permissions

[ArwaAldoud]

Thank you for sharing the links and providing more context.

based on experience, Power BI Desktop often requires at least Viewer-level access to the workspace to discover and connect to the model. This is because Power BI Desktop interacts with the workspace to locate the model, even if the user doesn't need to view the workspace contents directly.

While Build permissions allow a user to create reports from the model, they don't inherently grant the ability to discover the model in Power BI Desktop if the workspace is inaccessible.

If your goal is to restrict workspace visibility while ensuring access to the model, consider these options:

- Shared Dataset Access: Publish the model to a separate workspace, grant Build permissions to users, and restrict their access to other content.
- XMLA Endpoint: If using Premium (P SKU) or Fabric (F SKU) capacity, you can connect via XMLA Endpoints in Power BI Desktop. This method allows access without requiring Viewer permissions, but it's only available for Premium or Fabric users, not Pro users.

[Deku]

I had the reverse problem where viewer role was overwriting build permission 

[arock-well]

Thanks! However, do I need both of those permissions set for what I was originally asking?