Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Microsoft is giving away 50,000 FREE Microsoft Certification exam vouchers. Get Fabric certified for FREE! Learn more

Reply
arock-well
Responsive Resident
Responsive Resident

Model Build Permissions AND Viewer Workspace Permissions to Create Report?

On Fabric F64 SKU, does a user need not only Build permissions to a semantic model but also Viewer permissions in the workspace the model resides?

 

We're trying to figure this out, but giving only Build permissions doesn't appear to allow the user to connect to the model when in Power BI Desktop. I was hoping they didn't see the workspace in the Power BI Service, but just access to the model only.

1 ACCEPTED SOLUTION
ArwaAldoud
Continued Contributor
Continued Contributor

Hi @arock-well 
Yes, in most practical scenarios, especially when using Power BI Desktop, a user will likely need both Build permissions on the semantic model and Viewer permissions on the workspace to effectively create reports.

- Build permission only (No Viewer access) → The user might not see the model in Power BI Desktop.
- Viewer access only (No Build permission) → The user can view reports but cannot create new ones from the model.
- Want access to the model without exposing the workspace? → Consider using Shared Dataset Access from another workspace.

If this response was helpful, please accept it as a solution and give kudos to support other community members

View solution in original post

9 REPLIES 9
v-achippa
Community Support
Community Support

Hi @arock-well,

 

Thank you for reaching out to Microsoft Fabric Community.

 

Thank you @rohit1991@Deku and @ArwaAldoud for the prompt response.

 

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by the super user resolved your issue? or let us know if you need any further assistance.
If our super user response resolved your issue, please mark it as "Accept as solution" and click "Yes" if you found it helpful.

 

Thanks and regards,

Anjan Kumar Chippa

After further testing, it seems that applying Viewer permissions still does not allow connections to models.

 

However, if I grant Contributor permissions, it appears this does allow for that. This link has some footnotes that explain this: Roles in workspaces in Power BI - Power BI | Microsoft Learn

 

However, footnote 10 says this:

 

10 Consuming data from a dataflow gen2 with the dataflow connector requieres Admin, Member or Contributor permissions. Viewer permissions is not sufficient and is not supported for consuming data from the dataflow gen2.

 

The problem with this is all my dataflows are Gen1, so this footnote is apparently wrong.

 

In any case, granting users Contributor roles is allowing them to have more permissions to a Workspace than we want to allow, such as being able to delete content in the Workspace.

 

I'm hoping that Microsoft can modify or add a role to simply only allow users to connect to semantic models and that's it.

rohit1991
Super User
Super User

Hi @arock-well,

Yes, on Fabric F64 SKU, a user typically needs both Build permissions on the semantic model and at least Viewer permissions in the workspace where the model resides to connect to it in Power BI Desktop. While Build permissions allow users to create reports based on the model, Viewer permissions in the workspace ensure visibility and access to the model within Power BI Service. 

 

Without Viewer permissions, users may struggle to connect to the model from Power BI Desktop, as workspace security settings can restrict access. Unfortunately, this also means they will see the workspace in Power BI Service, even if you only want them to interact with the dataset. A potential workaround is using shared datasets from a separate workspace to control visibility while ensuring proper access.

 

Passionate about leveraging data analytics to drive strategic decision-making and foster business growth.

Connect with me on LinkedIn: Rohit Kumar

Deku
Community Champion
Community Champion

Build only, viewer would stop build from applying 


Did I answer your question?
Please help by clicking the thumbs up button and mark my post as a solution!
ArwaAldoud
Continued Contributor
Continued Contributor

Hi @arock-well 
Yes, in most practical scenarios, especially when using Power BI Desktop, a user will likely need both Build permissions on the semantic model and Viewer permissions on the workspace to effectively create reports.

- Build permission only (No Viewer access) → The user might not see the model in Power BI Desktop.
- Viewer access only (No Build permission) → The user can view reports but cannot create new ones from the model.
- Want access to the model without exposing the workspace? → Consider using Shared Dataset Access from another workspace.

If this response was helpful, please accept it as a solution and give kudos to support other community members

None of these links appear to indicate someone must have Viewer permissions to a Workspace to be able to connect to a model, which is what we want. We don't want or need someone to view the workspace contents, just be able to connect to a model in Power BI Desktop with Build permissions set on the model. It's very confusing.

 

https://learn.microsoft.com/en-us/power-bi/connect-data/service-datasets-permissions

https://learn.microsoft.com/en-us/power-bi/connect-data/service-datasets-manage-access-permissions

https://learn.microsoft.com/en-us/power-bi/connect-data/service-datasets-build-permissions

Thank you for sharing the links and providing more context.

 

based on experience, Power BI Desktop often requires at least Viewer-level access to the workspace to discover and connect to the model. This is because Power BI Desktop interacts with the workspace to locate the model, even if the user doesn't need to view the workspace contents directly.

 

While Build permissions allow a user to create reports from the model, they don't inherently grant the ability to discover the model in Power BI Desktop if the workspace is inaccessible.

 

If your goal is to restrict workspace visibility while ensuring access to the model, consider these options:

- Shared Dataset Access: Publish the model to a separate workspace, grant Build permissions to users, and restrict their access to other content.
- XMLA Endpoint: If using Premium (P SKU) or Fabric (F SKU) capacity, you can connect via XMLA Endpoints in Power BI Desktop. This method allows access without requiring Viewer permissions, but it's only available for Premium or Fabric users, not Pro users.

 

Deku
Community Champion
Community Champion

I had the reverse problem where viewer role was overwriting build permission 


Did I answer your question?
Please help by clicking the thumbs up button and mark my post as a solution!
arock-well
Responsive Resident
Responsive Resident

Thanks! However, do I need both of those permissions set for what I was originally asking?

Helpful resources

Announcements
Notebook Gallery Carousel1

NEW! Community Notebooks Gallery

Explore and share Fabric Notebooks to boost Power BI insights in the new community notebooks gallery.

April2025 Carousel

Fabric Community Update - April 2025

Find out what's new and trending in the Fabric community.

"); $(".slidesjs-pagination" ).prependTo(".pagination_sec"); $(".slidesjs-pagination" ).append("
"); $(".slidesjs-play.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-stop.slidesjs-navigation").appendTo(".playpause_sec"); $(".slidesjs-pagination" ).append(""); $(".slidesjs-pagination" ).append(""); } catch(e){ } /* End: This code is added by iTalent as part of iTrack COMPL-455 */ $(".slidesjs-previous.slidesjs-navigation").attr('tabindex', '0'); $(".slidesjs-next.slidesjs-navigation").attr('tabindex', '0'); /* start: This code is added by iTalent as part of iTrack 1859082 */ $('.slidesjs-play.slidesjs-navigation').attr('id','playtitle'); $('.slidesjs-stop.slidesjs-navigation').attr('id','stoptitle'); $('.slidesjs-play.slidesjs-navigation').attr('role','tab'); $('.slidesjs-stop.slidesjs-navigation').attr('role','tab'); $('.slidesjs-play.slidesjs-navigation').attr('aria-describedby','tip1'); $('.slidesjs-stop.slidesjs-navigation').attr('aria-describedby','tip2'); /* End: This code is added by iTalent as part of iTrack 1859082 */ }); $(document).ready(function() { if($("#slides .item").length < 2 ) { /* Fixing Single Slide click issue (commented following code)*/ // $(".item").css("left","0px"); $(".item.slidesjs-slide").attr('style', 'left:0px !important'); $(".slidesjs-stop.slidesjs-navigation").trigger('click'); $(".slidesjs-previous").css("display", "none"); $(".slidesjs-next").css("display", "none"); } var items_length = $(".item.slidesjs-slide").length; $(".slidesjs-pagination-item > button").attr("aria-setsize",items_length); $(".slidesjs-next, .slidesjs-pagination-item button").attr("tabindex","-1"); $(".slidesjs-pagination-item button").attr("role", "tab"); $(".slidesjs-previous").attr("tabindex","-1"); $(".slidesjs-next").attr("aria-hidden","true"); $(".slidesjs-previous").attr("aria-hidden","true"); $(".slidesjs-next").attr("aria-label","Next"); $(".slidesjs-previous").attr("aria-label","Previous"); //$(".slidesjs-stop.slidesjs-navigation").attr("role","button"); //$(".slidesjs-play.slidesjs-navigation").attr("role","button"); $(".slidesjs-pagination").attr("role","tablist").attr("aria-busy","true"); $("li.slidesjs-pagination-item").attr("role","list"); $(".item.slidesjs-slide").attr("tabindex","-1"); $(".item.slidesjs-slide").attr("aria-label","item"); /*$(".slidesjs-stop.slidesjs-navigation").on('click', function() { var itemNumber = parseInt($('.slidesjs-pagination-item > a.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); });*/ $(".slidesjs-stop.slidesjs-navigation, .slidesjs-pagination-item > button").on('click keydown', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); var itemNumber = parseInt($('.slidesjs-pagination-item > button.active').attr('data-slidesjs-item')); $($('.item.slidesjs-slide')[itemNumber]).find('.c-call-to-action').attr('tabindex', '0'); }); $(".slidesjs-play.slidesjs-navigation").on('click', function() { $.each($('.item.slidesjs-slide'),function(i,el){ $(el).find('.c-call-to-action').attr('tabindex', '-1'); }); }); $(".slidesjs-pagination-item button").keyup(function(e){ var keyCode = e.keyCode || e.which; if (keyCode == 9) { e.preventDefault(); $(".slidesjs-stop.slidesjs-navigation").trigger('click').blur(); $("button.active").focus(); } }); $(".slidesjs-play").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-stop").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-play")) { $(".slidesjs-stop").focus(); } } }); $(".slidesjs-stop").on("click",function (event) { if (event.handleObj.type === "click") { $(".slidesjs-play").focus(); } else if(event.handleObj.type === "keydown"){ if (event.which === 13 && $(event.target).hasClass("slidesjs-stop")) { $(".slidesjs-play").focus(); } } }); $(".slidesjs-pagination-item").keydown(function(e){ switch (e.which){ case 37: //left arrow key $(".slidesjs-previous.slidesjs-navigation").trigger('click'); e.preventDefault(); break; case 39: //right arrow key $(".slidesjs-next.slidesjs-navigation").trigger('click'); e.preventDefault(); break; default: return; } $(".slidesjs-pagination-item button.active").focus(); }); }); // Start This code is added by iTalent as part of iTrack 1859082 $(document).ready(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); $("#tip2").attr("aria-hidden","true").addClass("hidden"); $(".slidesjs-stop.slidesjs-navigation, .slidesjs-play.slidesjs-navigation").attr('title', ''); $("a#playtitle").focus(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").mouseover(function(){ $("#tip1").attr("aria-hidden","false").removeClass("hidden"); }); $("a#playtitle").blur(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#playtitle").mouseleave(function(){ $("#tip1").attr("aria-hidden","true").addClass("hidden"); }); $("a#play").keydown(function(ev){ if (ev.which ==27) { $("#tip1").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); $("a#stoptitle").focus(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").mouseover(function(){ $("#tip2").attr("aria-hidden","false").removeClass("hidden"); }); $("a#stoptitle").blur(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").mouseleave(function(){ $("#tip2").attr("aria-hidden","true").addClass("hidden"); }); $("a#stoptitle").keydown(function(ev){ if (ev.which ==27) { $("#tip2").attr("aria-hidden","true").addClass("hidden"); ev.preventDefault(); return false; } }); }); // End This code is added by iTalent as part of iTrack 1859082
Top Solution Authors
Top Kudoed Authors