Power BI reports support OAP exceptions for semantic models in separate workspaces (Preview)

Workspace outbound access protection (OAP) helps you control where data in a Microsoft Fabric workspace can flow. The initial preview for Power BI reports, launched in June, required a report in an OAP-protected workspace to use a semantic model in that same workspace. Customer feedback highlighted that this was too restrictive. With this improvement, a report can now query a semantic model in another workspace provided a workspace administrator explicitly allowed that destination through an OAP exception policy.

Apply exception policies to allow report-to-model connections

OAP continues to block outbound report-to-model connections by default. When a report opens, Power BI evaluates the report workspace policy before it renders the report in the browser. If the destination workspace is covered by an applicable exception, the report can connect to its semantic model. Otherwise, Power BI blocks the connection, and the report does not open.

The report honors the policy that a workspace admin configured for the semantic model destination. You don't configure an exception on each report, and you don't need to move the report and semantic model into the same workspace. The OAP exception policy supports a common Power BI architecture: a central team manages shared semantic models in one workspace, while business teams build reports in separate workspaces. You can preserve that separation of ownership without removing the outbound boundary from the report workspace.

See the improvement in action

The following example shows a report stored in an OAP-protected workspace, and its semantic model is stored in another workspace. First, the report does not have an applicable exception policy. Power BI blocks the cross-workspace connection and displays the following error because the report can't access its semantic model.

Figure: OAP continues to block outbound report-to-model connections by default.

Next, a workspace admin creates an exception policy for the semantic model workspace. In the workspace settings under Outbound networking, select Add new cloud connection rule, select Power BI Semantic Model as the Connection Kind, and select the desired semantic model workspace under Workspace exception, as in the following screenshot. Select Add, and then select Save to save the Data Connection rules.

 

Figure: An OAP exception policy to allow report-to-model connections.

After the policy takes effect, the same report loads and its visuals render successfully. The report binding doesn't change. The OAP policy determines whether the cross-workspace connection is allowed. The semantic model remains subject to its own OAP controls. Connections from the semantic model to cloud databases, on-premises systems through gateways, lakehouses, warehouses, and other sources are still evaluated against the semantic model workspace's data connection rules. Make sure you enable OAP for both, the report workspace as well as for the semantic model workspace.

Next steps

Work with your workspace admin to confirm that your report workspace meets the OAP prerequisites and that OAP is enabled. Then create an exception policy for each approved semantic model destination. Policy changes can take about 15 minutes to propagate.

For configuration details, refer to the Workspace outbound access protection for Power BI reports documentation. To understand downstream enforcement, refer to Workspace outbound access protection for semantic models.