RLS and Access to Semantic Model

[Hoping]

I am trying to test RLS implement on a semantic model without giving access to clients.

I am using Security --> Test Role  to make sure RLS is working as intended in DEV environment. The Report and Semantic Model have been implemented on 2 different obix files.

I have a Viewer AD group for each role - Role-A-Viewer and Role-B-Viewer

I have 3 questions:

Question 1: If I add the client to the Viewer AD group for a Role, will they get access to the report and / or semantic model ? This is in DEV and we don't create Apps here.

Question 2: When I tried to test with a testuser ID, I get an error that the user doest not have access to dataset or report.  After searching online, a post said I need to provide "Read" access to dataset.  When I click on Manage Permissions, I only see options to modify, share or build but NOT Read. How can I provide "READ" access to the dataset if that's what is causing that error displayed as a banner on the top.

Question 3: In production however, we create an App and give access to clients by adding them to AD group that has access to the App. No one is given explicit access to dataset. Does this implicitly give Read access to the memebers of the AD group ? In other words if a person is a viewer in an app do they get "READ" access to dataset automatically ?

[lbendlin]

You are mixing a couple of concepts here. Assuming you are on premium. You should NOT give ANY access to the workspace. Instead, give access through the app.  Unless you enabled auto app install, there is one additional step that all users need to complete - they need to "install"  (register) the app  before they can consume the reports or use the XMLA endpoints.