Need to implement - 1 semantic data model - 2 reports (1 with rls and 1 without rls)

[Arti173]

Hi,

I have created a common semantic data model. On this data model we are creating 2 power bi reports. 

Report 1 - needs to have RLS.

Report 2 - Should be without RLS. 

We initially thought we will built a common semantic data model and then tie Report 1 with an RLS excel file. But we are unable to filter rows from common semantic data model in Report 1. 

Now, we are thinking of putting RLS in common semantics data model, which makes Report 1 as expected, but then we are unable to bypass RLS in Report 2. 

Can anyone please help me with this issue? How can i design the data model and report to acheive my goal?

[v-pnaroju-msft]

Hi Arti173,

We are following up to see if your query has been resolved. Should you have identified a solution, we kindly request you to share it with the community to assist others facing similar issues.

If any response was helpful, please mark it as the accepted solution, as this helps the broader community.
Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Hi Arti173,

We would like to know if the details we shared have helped solve your problem. If you require any additional assistance, feel free to connect with the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Hi Arti173,

We would like to follow up and see whether the details we shared have resolved your problem.
If you need any more assistance, please feel free to connect with the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft · Accepted solution]

Thankyou @rohit1991, @BhavinVyas3003, for your response.

Hi Arti173,

We appreciate your question on the Microsoft Fabric Community Forum.

From what I understand, Power BI applies Row-Level Security (RLS) at the dataset level. When RLS is set on a dataset (semantic model), it works automatically for all reports connected to that dataset. This stops RLS from being ignored in one report while working in another, if both use the same dataset.

Please follow these steps which might help solve the problem:

1. If you want two reports (Report 1 with RLS and Report 2 without RLS), do not apply RLS directly on the shared dataset.
2. Keep the main semantic model without RLS. Then create two small local semantic models using DirectQuery on the shared dataset with composite models. For Report 1, add a local user mapping table and apply RLS only in the local model. For Report 2, do not apply RLS, so it has full access.
   This way, you can enforce RLS only where needed without making copies of datasets or changing the shared model structure.

Also, please check these links:
Use composite models in Power BI Desktop - Power BI | Microsoft Learn
Use DirectQuery in Power BI Desktop - Power BI | Microsoft Learn

We hope this information helps you fix the issue.
If you have more questions, please feel free to ask the Microsoft Fabric community.

Thank you.

[BhavinVyas3003]

Option 1: Composite Model Approach
Create and publish one common semantic model without RLS. Then, for each report, create a new Power BI file that connects to this model using DirectQuery (Power BI dataset). In Report 1, add a local RLS table and define RLS roles there. In Report 2, simply connect to the model without adding any RLS logic. This keeps the central model clean and allows different RLS behavior in each report.

---

Option 2: Duplicate Dataset Approach
Create the common semantic model, then publish it twice to Power BI Service as two separate datasets. Apply RLS only in Dataset A (used by Report 1), and leave Dataset B without RLS (used by Report 2). This works without using composite models but requires maintaining two datasets separately.

[rohit1991]

Hi @Arti173 

This is a pretty common issue when trying to reuse a semantic model for both secured (RLS) and open access reports.

Here’s the thing: once you apply RLS in a model, Power BI enforces it everywhere that model is used. So Report 2 will always be affected by RLS, whether you want it or not. There's no built-in way to say “apply RLS only to Report 1 but not Report 2” if both are connected to the same dataset.

Option 1 (cleanest):
Make a copy of your semantic model:

a. One version with RLS (for Report 1)

b. One version without RLS (for Report 2)

Yeah, it’s not the most elegant from a maintenance standpoint, but it’s simple and works.

Option 2 (if you really want one model):
Use a conditional RLS setup. Like, in your security table, add a column ApplyRLS, then define the role like this:

[Username] = USERNAME() && [ApplyRLS] = TRUE()

This way, only users marked for RLS will get filtered, and you can use a “dummy” user or service principal for Report 2 that doesn't trigger RLS. But you’ll still need to be super careful with access and publishing.