Today, i was checking who has build permissions to one of published semantic models (datasets).
I knew that one AD group which contains all users with Pro license have build permissions – which was expected.
However, i found out that also several user without Pro license have build permissions – which means they can create reports linked to this semantic model.
Furthermore, this semantic model has RLS, so i was intrigued what these Free users (without Pro license) can see, create and publish (share with other users).

This was my scenario:
1. Power BI Premium capacity
2. Free users (without Pro license) have access to the app (not workspace)
3. Free users have read and build permissions to semantic model
4. The semantic model has RLS

Questions i wanted to answer:
1. Can free user connect to the semantic model and create report
2. Does this work in all environments (Power BI Desktop app, Power BI Service, Excel)?
3. Can free user see all data in semantic model or only data based on RLS?
4. Can free user share the created report?

Semantic Model – permissions basics

Before granting user permission to reports, always make sure to firstly grant proper dataset permissions.

There are 2 types of permissions to think about when we talk about semantic model:

1. Semantic model PERMISSIONS – here we define who can access this semantic model and read data from it or create reports based on this semantic model
2. Semantic model SECURITY – if we have RLS set, here we define to which role we will assign the user. Example, user John Johnson will be added to role “Sales Europe” as he should see only data for Europe – not for other markets.
If you do not user RLS (row level security), then you will not need this “Security” option.

If you use RLS, it is not enough to just give user access to semantic model, you also need to set to which RLS role new user should have access to.

When giving basic permissions, READ permission is mandatory.
This is why, when we add new user to our semantic model, we do not se option to grant read permission.
We can see only options:
1. Modify = make changes to the semantic model
2. Share = users who have share option can share reports which were built based on this semantic model
3. Build = users can create reports based on this semantic model

Whatever you choose, you will have read permission + whatever is selected on this pop-up window:

Now, let’s get back to answering questions…

Here are conclusions!

Can a free user connect to the semantic model and create report?

YES. Users do not need to have pro license to connect to published semantic model. It is enough to give them build permissions.

Does this work in all environments (Power BI Desktop app, Power BI Service, Excel)?

Partially.
Free users can connect to a published dataset via Power BI desktop app or via Excel. This will work!
However, it will not work via Power BI Service! Report creation in the service requires a Pro or PPU license.

Can free user see all data in semantic model or only data based on RLS?

The free user with build permission to the semantic model will see only data that is allowed by RLS – nothing more!

Free users cannot bypass RLS.

Why is this important?
Because, if the user has a Pro license and a role of admin/member/contributor on a workspace level, it will override RLS.
Example, if John is a contributor and has pro license, this means that he can create report and will see ALL data. RLS will not work.

RLS works only if users has VIEWER workspace role or if user has access only to the APP (not workspace) or if it is FREE user.

If free users gets for example contributor role, RLS will still work. It will not be dismissed by contributor role.

Can a free user share the created report?

NO.
Free users can create reports and publish them to “My Workspace” without a Pro license.
However, they cannot publish to shared Premium workspaces and share with others unless they have a Pro license.
When a free user attempts to publish a report to a Premium workspace (even if they have Contributor or Viewer role), Power BI requires a Pro license for that action. This is the limitation.

FINAL CONFIRMATION

• Free user with build permissions can connect to published dataset via Power BI desktop app or Excel. Not via Power BI Service
• RLS will work for free users even if they are set as contributor role on the workspace
• Free user can create a report, but can’t share it with other users on Power BI service. This functionality requires Pro license

Power BI has amazing data security.
But, we need to be very careful and pay attention to every detail.
If we do not test each scenario, we can get in a big trouble.