Note
Access to this page requires authorization. You can try signing in or changing directories.
Access to this page requires authorization. You can try changing directories.
Manage semantic model access permissions in Power BI to keep your sensitive data secure. You can monitor and control who has access to your semantic model through three tabs:
- Links: Review and remove links for shared reports that use your semantic model. These links might also grant access to the semantic model.
- Direct access: Review, add, modify, or remove access for specific people or groups, including distribution groups and security groups.
- Access via related items: Review access granted through related items, such as org apps.
This article explains how to use the manage permissions page to control access to your semantic model.
Note
To access a semantic model's manage permissions page, you must have an Admin or Member role in the workspace where the semantic model is located.
Open the semantic model manage permissions page
To open the semantic model manage permissions page:
From the OneLake catalog or the workspace that contains the semantic model, select More options (...) next to the semantic model, and then select Manage permissions.
From the semantic model details page, select Manage permissions on the action bar.
Manage direct access
The Direct access tab lists people and groups that have access to the semantic model. The Permissions column shows both the effective access and, in some cases, how the principal received access. Values can include:
- Semantic model permissions, such as Read, Write, Reshare.
- A workspace role or ownership, such as Workspace Admin.
- An access source followed by semantic model permissions in parentheses, such as App (Reshare, Build).
To modify permissions, select More options (...) for the person or group, and then remove or add one of the following permissions:
- Reshare
- Build
- Write
- Access
To grant semantic model access to another person or group, select Add user. The Share semantic model dialog opens.
Manage permissions granted through an app
For access granted through an app, the Permissions column shows App followed by the semantic model permissions in parentheses, as shown in the following image.
You can't modify permissions granted through an app directly from the Direct access tab. First, remove the permissions from the app configuration:
Edit the app, and clear the relevant options on the Audience tab of the app configuration.
Republish the app.
Return to the Direct access tab as described in Manage direct access. The permissions that the app previously granted remain, but they're no longer tied to the app. The parentheses no longer appear, and you can remove the permissions individually.
Manage links
The Links tab lists links created for shared reports that use your semantic model. Because these links might also grant access to the underlying semantic model, the page lists the permissions that each link grants, who can use the link, and who created it. You can also delete a link.
Warning
Deleting a link removes it from Power BI. People who use the link might lose access to the report.
Manage access via related items
The Access via related items tab lists access to the semantic model that comes from related items. For example, an org app can grant access to an included report and its underlying semantic model. Review this tab when you need to understand why a person or group has access that isn't listed as direct access or through a sharing link.
When access from an org app isn't automatically revoked, a related access record can remain on the semantic model. A semantic model owner or another authorized user can review and remove the record from this tab. For more information, see Manage org app permissions.