Suppose your governance team approves Copilot for Power BI across three business units. The reports already have RLS, and each department sees the right figures. Then someone asks Copilot about the DAX behind a margin calculation rather than asking for another sales summary.
If that person has access to a feature that reads model definitions, the question may bring up business logic the team never reviewed for wider use. The concern isn't that RLS has stopped working. It's that the original security review may never have covered the model information Copilot can work with.
What Copilot Actually Reads From Your Semantic Model
A Power BI report shows calculation results, but the semantic model contains the structure behind them. Table names may identify internal projects, while a measure can show how the business calculates revenue risk. RLS filters rows according to a user's assigned role. It does not make the rest of the model private.
Microsoft's Copilot privacy and security documentation describes different inputs for different features. When Copilot creates or explains DAX queries, it uses semantic model metadata, including table and column names. It can also use the selected measure's formula when writing a measure description. Access to those features still depends on the user's permissions, so the metadata use alone does not prove that a restricted viewer can retrieve hidden formulas.
Table Names, Column Names, and Measure Definitions
Consider a model with a table called ChurnRiskByAccount_Internal. The name suggests the company tracks accounts that may leave, without revealing a single customer record. A measure tied to that table might also describe how the risk score is worked out. Those details could matter to a competitor or a customer who should never see the internal method.
RLS can keep restricted rows out of a regional sales report without hiding these names. That is the gap teams need to check when a Copilot feature can work with model definitions. The result depends on the feature being used and the account's permissions, not simply on the presence of an RLS role.
What Microsoft Documents Copilot Uses
Microsoft says Copilot data stays within the organization's tenant boundary and is not used to train foundation models. It also says Copilot does not retain prompts or replies after a session ends. These statements address how Copilot handles information after it receives it.
An important difference exists between AI report summarisation and DAX assistance. Microsoft's report summary guidance says summaries respect RLS and OLS. Its DAX guidance separately confirms that DAX assistance reads model metadata. A team that tests only report summaries has not tested every Copilot feature that can work with the semantic model.
Why This Matters Now
Power BI teams often have years of RLS rules behind their reports. When Copilot arrives, it is tempting to reuse the same approval process and treat the AI feature as another way to view the dashboard. But a prompt about a measure's definition is different from a request to summarise a sales chart. The team must know which features each user has before deciding existing tests are enough.
That forecast concerns AI data handling in general, not Power BI metadata exposure. It does show why teams are paying closer attention to what information an AI feature receives. For Copilot, the immediate question is much narrower: has the team tested what each permitted feature can read from the model?
RLS vs. OLS: Where the Gap Actually Lives
Row-Level Security: Filters Data, Not Metadata
Suppose an analyst has access to sales rows for the North region. RLS can remove South region records from the analyst's results. But the model may still contain tables and calculations used by both regions because a row filter doesn't hide the objects themselves. Microsoft's RLS guidance points to object-level security when teams need to restrict access to columns and their metadata.
There is also a role limit worth checking. In a Power BI workspace, RLS applies to Viewers, not users with Admin, Member, or Contributor access. Someone given an editing role may have much broader access to the model than the reporting team intended. The workspace role should therefore be reviewed alongside the RLS rule.
Object-Level Security: Hides Protected Model Objects
Object-level security can hide a table or column from users without permission to see it. Microsoft's OLS documentation also says it can hide protected object names and metadata. For the affected viewer, a secured table appears not to exist. This is the control that addresses schema visibility rather than just filtering data rows.
Closing the Gap With Governed Semantic Model Design
A report can pass its RLS checks while the wider Copilot rollout still needs work. The next review should focus on model details that users have no reason to discover. It should also cover the AI features made available to each group, rather than treating all Copilot experiences as one product.
This is not only a technical issue. In September 2026, Gartner predicted that 60% of organizations that do not address the cultural challenges of data governance will fail to govern AI successfully by 2027. Model owners and security reviewers need to agree on what counts as sensitive before the rules can reflect those decisions. Otherwise, a table can be technically accessible and still reveal something the business intended to keep private.
Where BI Genius Fits: AI You Can Audit
A security review is stronger when administrators can see what an AI system did with a question. BI Genius, Reporting Hub's AI agent product, connects to existing Power BI semantic models and runs inside the customer's Azure environment. Reporting Hub documents support for Power BI RLS and role-based controls that limit access to particular data sources. An organization can also set different knowledge boundaries for different agents.
BI Genius provides an AI Logic Dashboard with an interaction history and the sources behind answers. This lets administrators inspect the queries and DAX involved when an answer needs review. The records remain in the customer's own Azure setup rather than a shared hosted service. These controls don't replace OLS or prove that every model object is protected, but they give the reporting team evidence to review alongside its access rules.
Frequently Asked Questions
Does turning off Copilot's Q&A feature stop schema exposure?
Disabling Q&A removes that way of asking data questions, but other Copilot features have their own inputs. Microsoft's DAX-assistance documentation says those features use semantic model metadata. Teams need to review the features and permissions available to each user rather than relying on a single Q&A setting.
Is this a Microsoft bug or a limitation of RLS?
RLS was made to filter data rows, not to hide tables or columns. Microsoft documents object-level security for protecting those objects and their metadata. The risk arises when a team treats a working RLS report as proof that all model details are hidden, especially when adding AI features that can work with those details.
Does OLS fully prevent Copilot from referencing hidden columns?
OLS is Microsoft's model-level control for hiding selected tables and columns from restricted viewers. But Microsoft's documentation doesn't provide a single test that confirms the behavior of every Copilot feature. The team should test each enabled feature with real accounts, including a user whose role hides the chosen object.
Should we pause a Copilot rollout until every model has OLS?
Not every semantic model needs OLS. The decision depends on which objects contain information the business needs to restrict and which users can access them. A limited rollout can start with reviewed models, while more sensitive ones stay out of scope until you've checked their permissions.
Does the same risk apply to paginated reports or dashboards?
Paginated reports and dashboards have their own access rules. They do not automatically give viewers the DAX-assistance features described here. This article focuses on Copilot experiences that use semantic model metadata; check report summaries separately, and Microsoft says those summaries enforce RLS and OLS.