5.2.2. Semantic Model Permissions
💡 First Principle: A semantic model can be reached in more ways than through its reports: users can build new reports on it, analyze it in Excel, query it with DAX, or connect through composite models. Semantic model permissions control those direct uses, independent of the reports built on top.
| Permission | Allows | Typical source |
|---|---|---|
| Read | View reports and dashboards that use the model; query data through those reports | Sharing a report, app access, Viewer role |
| Build | Create new reports and composite models on the model, Analyze in Excel, use it in other workspaces, export underlying data | Granted explicitly on the model, via app settings, or by workspace role Contributor and above |
| Reshare | Share the model with others (granting them Read, and Build if you have it) | Granted explicitly |
| Write | Edit the model, configure refresh, manage settings | Workspace Admin, Member, Contributor |
Grant permissions from the semantic model's Manage permissions page (Direct access tab: add users or groups, choose Build and Reshare options) or through app settings. Build is the key permission for self-service: without it, a user can view reports but can't create a thin report on the shared model, use Analyze in Excel, connect a composite model to it, or export underlying data (4.2.5).
RLS still applies to users with Read and Build if they aren't Admins, Members, or Contributors of the model's workspace: someone with Build can create their own report on the model but still sees only their permitted rows.
For models used across many workspaces, the OneLake catalog shows models users can discover; administrators can let users request access to discoverable models they don't yet have permission to use.
⚠️ Exam Trap: When an analyst can view reports but gets an error trying to create a new report on the shared semantic model or use Analyze in Excel, the missing permission is Build on the semantic model, not a workspace role. Granting Build is least privilege; adding them as Contributor over-grants edit rights and removes RLS.
Reflection Question: Why does Microsoft separate Read and Build on semantic models instead of letting anyone who can view a report also build new reports on its data?
