FabCon Europe 2026 in 18 demos · Part 2 of 18 · Defaults to check Monday
One AI toggle on every semantic model
Each semantic model has a switch that opens it to Copilot, data agents, and MCP tools for read-only users. It starts on, and chained models do not inherit it.
The semantic model AI setting is a checkbox on each Power BI semantic model, labeled “Allow any person with only read permissions to use AI.” It decides whether users with read-only permission can reach that model through Copilot, Microsoft 365 Copilot Chat and Cowork, the Fabric data agent, and remote Microsoft MCP tools. It is on by default. It is the second of two defaults covered in FabCon Europe 2026 in 18 demos.
Agents now pull answers out of Fabric through several doors. This switch lets a model owner close all of them for one model at once.
In short
- Every semantic model has a switch that opens it to Copilot, Microsoft 365 Copilot Chat and Cowork, the data agent, and remote Microsoft MCP tools. It is on by default.
- It governs read-only users. Turned off, it hides the model from AI search for everyone, but users with Build or Write still reach it by URL or by attaching it.
- The switch does not carry over to a model built on another model. Check each model in the chain, starting with HR and finance data.
What the semantic model AI setting is and how it works
The setting sits in each model's settings, under Explore and AI access on the full settings page. Users with write permission on the model can change it. It governs one group: people with read-only permission on the model.
One checkbox covers four experiences at once, as Figure 1 shows.
The tenant and capacity Copilot settings are blunt. Learn: “You can't enable or disable Copilot in specific workloads, or for specific Copilot experiences.” The model switch is where you say no for one model, across all four experiences.
Read-only users are a large group. The Fabric IQ MCP server needs no workspace role and no Build permission, so Read alone is enough, see part 3, the Fabric IQ MCP server. In the gate model of part 1, Fabric data in Microsoft Copilot, this switch is gate 3.
What the demo shows
The 11-second clip opens one synthetic model and scrolls to one checkbox.
- 0:00 Settings for Oud RnD. The description reads “Oud house R&D, synthetic data, Direct Lake on lh_oud_rd.” The configured-by field is blurred.
- 0:03 The page scrolls past refresh, Q&A, and other sections. A separate section, Approved for Copilot, sits below.
- 0:05 Explore and AI access expands. Two boxes are checked: Explore, and Copilot and Microsoft's MCP tools.
- 0:07 The cursor rests on the label: “Allow any person with only read permissions to use AI (i.e. Copilot, Microsoft's MCP tools) on this model and its related reports.” Apply stays grey.
Limits and catches
The catch: the setting is not inherited. A model built on another model has its own switch, and it starts on. Turning off AI on the HR model does nothing for the model your analysts built on top of it.
The switch governs read-only users only. Figure 3 shows what changes when you turn it off.
Two traps follow. Owners lose the model from AI search too, so they attach it by hand. Users with Build or Write still reach it through Copilot, so the switch limits exposure. Permissions, RLS, and OLS remain the data boundary.
Approved for Copilot is a different setting. It marks a model as prepared for AI and removes the low-quality warning in standalone Copilot. It controls nothing about access.
Learn documents the switch per model and names no tenant-wide default for it. Plan to check models one at a time.
How to check the AI setting on your semantic models
You need the Oud RnD model from the demo script and write permission on it. The steps follow runbook D02.
- Open the workspace, then the settings of the Oud RnD semantic model.
- Expand Explore and AI access.
- Find Allow any person with only read permissions to use AI. It is on by default.
- Turn it off on a model with sensitive data, then check a model built on top of it: the setting does not carry over.
python3 fabdemo.py up # workspace, data, and the Oud RnD model
Oud RnD > Settings > Explore and AI access
[x] Allow any person with only read permissions to use AI
(i.e. Copilot, Microsoft's MCP tools) on this model and its related reports.
python3 fabdemo.py capacity pause # when you are doneExpected result: the setting is on for a new model. Each model has its own switch, including models chained on another model. Time and cost: about 2 minutes on the F8 capacity from up. The recap README prices F8 at about 1.41 EUR per hour in France Central, Azure retail, on October 21, 2026.
What to do on Monday
On Monday: Check the AI setting on models with HR and finance data, and on every model built on top of them.
Key facts at a glance
Checked on Microsoft Learn on November 3, 2026.
| ID | Fact | Source |
|---|---|---|
| K1 | Label: Allow any person with only read permissions to use AI on this model and its related reports. | Use Copilot with semantic models |
| K2 | Covers Power BI Copilot, Microsoft 365 Copilot Chat and Cowork, Data Agent, remote Microsoft MCP tools. | Use Copilot with semantic models |
| K3 | Enabled by default. Users with write permission change it. | Use Copilot with semantic models |
| K4 | Off: read-only users lose all supported Copilot and MCP access. | Use Copilot with semantic models |
| K5 | Off: hidden from search for all users. Build and Write keep direct access. | Use Copilot with semantic models |
| K6 | Not inherited across semantic models. | Use Copilot with semantic models |
| K7 | Approved for Copilot removes friction warnings. It is not an access control. | Prepare your data for AI |
Frequently asked questions
What does “Allow any person with only read permissions to use AI” do?
It lets users with read-only permission on a semantic model reach it through Power BI Copilot, Microsoft 365 Copilot Chat and Cowork, the Fabric data agent, and remote Microsoft MCP tools. Turned off, those users cannot reach the model through any of them.
Is the semantic model AI setting on by default?
Yes. Microsoft Learn says the setting is enabled by default. A demo model recorded on October 19, 2026, showed the box checked with no change by its owner.
Does turning off the AI setting block the model's owners?
No. The model disappears from AI search results for all users, owners included. Users with Build or Write permission can still open the model URL or attach the model by hand.
Is the AI setting inherited by models built on another model?
No. Learn states that Copilot access settings are not inherited across semantic models. A model built on another model has its own switch, and that switch starts on.
What is the difference between Approved for Copilot and the AI setting?
Approved for Copilot marks a model as prepared for AI and removes the low-quality warning in standalone Copilot. The AI setting decides whether read-only users can reach the model through AI experiences at all.
Sources
Microsoft Learn, checked on November 3, 2026, then the recap materials.