Forum Discussion
RLS not working on shared model
I have a semantic model (import) in Workspace A which has dynamic row level security defined.
Added the roles and tested them with a report. That all works just fine.
In Workspace B I've made a new report (report B), connected to the semantic model from Workspace A. Also tested the RLS in this new report and that works as well.
But, as soon as I make changes to the model from report B, it gets its own (composite) semantic model and RLS to the shared model no longer works. Btw: report B does not have ane RLS roles defined itself.
Report B's semantic model uses a shared cloud connection (aas connection with Oauth) to the semantic model in Workspace A.
Are there any connection settings I'm overlooking?
Grant Build permission on Workspace A model to Report B users
Ensure SSO enabled on the AAS connection (OAuth)
Users must be assigned to RLS roles in Workspace A model (Dataset > Security)
If this answer helped, please click Kudos or Accept as Solution.
-Kedar
LinkedIn: https://www.linkedin.com/in/kedar-pande
3 Replies
Grant Build permission on Workspace A model to Report B users
Ensure SSO enabled on the AAS connection (OAuth)
Users must be assigned to RLS roles in Workspace A model (Dataset > Security)
If this answer helped, please click Kudos or Accept as Solution.
-Kedar
LinkedIn: https://www.linkedin.com/in/kedar-pandeThanks, that worked!
But this makes me curious.... Why are build permissions required in this situation?
I'd rather not hand out build permissions whenever this situation occurs...Hi Luuk_,
Thank you Kedar_Pande for your points.
When you modify Report B, Power BI creates a local composite semantic model, so the report is no longer directly connected to the shared model in Workspace A. Instead, it queries the shared model through this new local model. For this setup to function, users need Build permission on the original dataset, since a composite model extends or reuses the underlying dataset with custom modeling logic. Without Build permission, Power BI blocks users from querying the shared dataset via another model, which also interferes with RLS. Essentially, Build permission is necessary because creating a composite model means you are building on top of the shared dataset, and Power BI enforces this to ensure proper security and query handling.
Thank you and continue using Microsoft Fabric Communiy Forum.
