Forum Discussion
Helper IIUsers gained unauthorized access to reports!!! How to stop them?
Here it is the support team response.
It is not possible to restrict users from opening some of the repots sharing same semantic model. Actually, giving read access to the semantic model (which is required for the reports to work) automatically gives access to *ALL* the reports sharing the same semantic model. This is by design, they say.
I will have to develop a way to deny users access to undue reports using RLS features, somehow. Maybe using OLS. We'll see..
Community SupportHi iW1DOV,
Thank you for the update.
We kindly request you to share the feedback provided by the support team with the community. This will help others who are facing similar challenges and benefit the broader community members.
Helper IIHere it is the support team response.
It is not possible to restrict users from opening some of the repots sharing same semantic model. Actually, giving read access to the semantic model (which is required for the reports to work) automatically gives access to *ALL* the reports sharing the same semantic model. This is by design, they say.
I will have to develop a way to deny users access to undue reports using RLS features, somehow. Maybe using OLS. We'll see..
- v-pnaroju-msft
Hi iW1DOV,
Thank you for the detailed investigation and the findings that you have shared with the community. This will certainly assist other customers who are designing secure shared semantic model architectures in Microsoft Fabric and Power BI.Based on our understanding, in scenarios where different user groups require access to different reports while using the same underlying data source, the following approaches may be considered.
1.Implementing stringent Row Level Security (RLS) to ensure that users can only view the rows of data they are authorized to access.
2.Evaluating Object Level Security (OLS) if sensitive tables or columns also need to be restricted from unauthorized users.
3.Separating highly sensitive reports into dedicated semantic models when true report isolation is necessary.
4.Minimizing broad semantic model permissions wherever feasible.Additionally, kindly refer to the following documentation links:
Semantic model permissions - Power BI | Microsoft Learn
Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn
Analysis Services tabular model object-level security | Microsoft LearnWe hope that the above information is helpful in resolving your concern. Should you have any further queries, please feel free to contact the Microsoft Fabric community.
Thank you.