Forum Discussion
Two reports on one data model
Power BI currently allows only one app per workspace, so both reports would be included in the same app with audience-level visibility controlling which report each user sees. RLS is enforced at the semantic model level and applies globally to all reports connected to it, meaning you cannot enforce RLS for KPIs BA while leaving KPIs All unrestricted if both connect to the same semantic model. The recommended pattern for your scenario is to keep both reports in the same workspace and use app audiences to control report visibility, then assign the KPIs BA audience users to the appropriate RLS role in the semantic model security settings while leaving KPIs All users unassigned to any role (which bypasses RLS by default for workspace members). If KPIs All users must truly see all data without any RLS evaluation, ensure they have at minimum Member role on the workspace since Admins and Members bypass RLS automatically, while Viewers are subject to RLS.
RLS is welded at the model‑line, so one report can’t be unrestricted while the other is locked. The safe pattern is a tiny model‑dup → RLS only on the BA copy → publish from its own workspace/app.