Microsoft has added preview support for workspace outbound access protection (OAP) exceptions that let Power BI reports query semantic models in separate workspaces. The change matters for tenants that keep shared semantic models in central workspaces while report authors work elsewhere. OAP still blocks outbound report-to-model connections unless an administrator has allowed the destination workspace.
The initial preview for Power BI reports required a report in an OAP-protected workspace to use a semantic model in the same workspace. Microsoft says customer feedback showed that this was too restrictive. The new exception policy keeps the outbound boundary in place, but lets administrators approve specific semantic model workspaces as destinations.
Default blocking remains
When a report opens, Power BI evaluates the report workspace policy before it renders the report in the browser. If the destination workspace is covered by an applicable exception, the report can connect to its semantic model. If not, Power BI blocks the connection and the report does not open.
The report binding does not change, and administrators do not configure an exception on each report. A workspace administrator creates a cloud connection rule for the Power BI Semantic Model connection kind and selects the permitted semantic model workspace under Workspace exception. After the policy takes effect, the same report can load and render its visuals.
Impact on shared semantic model designs
The change supports a common Power BI pattern in which one team manages semantic models and other teams build reports in their own workspaces. Those teams can keep separate ownership of models and reports without moving items into a single workspace. The exception policy decides whether the cross-workspace connection is allowed.
The semantic model workspace remains subject to its own OAP controls. Connections from the semantic model to cloud databases, on-premises systems through gateways, lakehouses, warehouses and other sources are still evaluated against the semantic model workspace's data connection rules. Microsoft advises enabling OAP for both the report workspace and the semantic model workspace.
Admin requirements and timing
OAP requires an Admin role in the workspace. The workspace must be on a Fabric capacity using an F SKU, and other capacity types are not supported. The Fabric tenant administrator must also enable the tenant setting for workspace-level outbound network rules, and the Microsoft.Network feature must be re-registered for the subscription.
Administrators can enable OAP in the Fabric portal by turning on Block outbound public access in the workspace network security settings. They can also use the Fabric REST API to set the workspace outbound policy to deny public access. Once outbound public access is blocked, approved connections are added through data connection rules or managed private endpoints, depending on the workload.
Policy changes can take about 15 minutes to propagate. OAP is available only in regions where Fabric Data Engineering workloads are supported, and workspaces with unsupported items cannot enable OAP until those items are removed. For Power BI, OAP support covers semantic models, interactive reports and paginated reports; other Power BI items are not listed as supported.
Microsoft has not given a general availability date for this preview. For teams already testing OAP, the main planning task is to map which report workspaces need access to which semantic model workspaces, then create exception policies only for those destinations. That keeps the central model pattern available while preserving default blocking for other outbound connections.
Report-to-model exceptions under OAP, central semantic model ownership and downstream connection rules are the governance detail ECS's Data topic covers, alongside Microsoft Fabric, Power BI, SQL Server and Dataverse. Sessions and workshops give attendees room to compare design patterns, workspace policies and practitioner experience from Fabric and Power BI deployments. Attend with the workspace layouts and exception rules you are considering, and use the conference to test them against people who run these platforms.
This article was written by the ECS editorial team with the assistance of Amal Agent, run.events' AI assistant, which supported the research, drafting and proofreading.