Read permission on in place shared semantic model

[MCarmassi]

I have a semantic model in my tenant which is shared to some users who are external to my organization. They can correctly access and build report on the shared dataset connected in direct query. They want to share their report with other users in their organization who shouldn't be able to build new report from the shared dataset. I thought it was enough to give these new user read permission on the shared dataset, but with only read they can't see the data. If I give them full permission everything is fine.

Is there some limitation to this kind of sharing such that read is not enough?

[v-yaningy-msft]

Hi, @MCarmassi 

Users with only Read or Build permission on the semantic model will not be able to read data from the semantic model unless they belong to one of its Row-Level Security (RLS) roles. Users with Write permission on the semantic model will be able to read data from the semantic model regardless of whether or not they belong to any of its RLS roles.

So, if you want these new users to only view the data but not build new reports, you might need to assign them to an appropriate RLS role in addition to giving them Read permission.

Official document:
Semantic model permissions - Power BI | Microsoft Learn
How to configure RLS: Row-level security (RLS) guidance in Power BI Desktop - Power BI | Microsoft Learn

Best Regards,
Yang
Community Support Team

If there is any post helps, then please consider Accept it as the solution to help the other members find it more quickly.
If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

How to get your questions answered quickly --  How to provide sample data in the Power BI Forum

[MCarmassi]

Thank you for your response. There is no RLS security on my model, by the screenshot you posted users with read permission should be able to access the data, but they can't.