RSMUS.comWhen using Power BI, an area that is highly overlooked is the organization of sharing and securing reports once they are published in Power BI service. In the Power BI service, access and permissions are managed in multiple places including apps, workspaces, reports, and datasets. If you’ve worked in this area before, you know these sharing and security layers can be difficult to understand.
Sharing Capabilities in Power BI Service
Once a Power BI report is published from Power BI Desktop, it is ready to be shared. There are 3 different ways to manage the sharing of a report.
Sharing Individual Reports: A Power BI report owner has the ability to create a workspace or use their personal workspace within Power BI service for the reports that they choose to publish. From any workspace, that report owner has the ability to individually “share” the report with any individual within the organization. Typically, this is useful when a certain individual needs quick access to a report. For an entire organization, distributing access on an individual level can be difficult to manage in the long term as reports and end-users grow in numbers.
Sharing Reports in a Workspace: As mentioned above, a Power BI report owner with the proper permissions has the ability to create a workspace within the Power BI service for the reports that they choose to publish. When managing access for a workspace, you can add individual members in addition to user groups/mail listings. Using groups can be easier for long-term team management in case an employee switches teams or if a new hire is brought onto a team.
Sharing Apps: Within workspaces, users can collaborate to verify content (reports and dashboards) and package that content into a Power BI app for distribution to large groups within their organization. Access to the app can be given to the entire organization, groups, or individuals. There are additional app settings that can be used to control if end-users can connect to the underlying data. The benefits of using apps stem from the ability to formalize content, distribute it to large audiences, and have more control over layout & navigation.
Security in Power BI Service
Dataset Security: The first layer of security lies in the dataset itself. Row-level security can be implemented in Power BI desktop for certain data sources to restrict users to only see filtered data based on which roles they are given. It is also possible to allow or deny users access to create their own reports using the dataset of the report that has been shared with them by giving them “build” permissions for the dataset.
Workspace Security: Once reports are published to their respective workspaces, a user can control workspace access. A user can be assigned 1 of 4 levels: Admin, Member, Contributor, or Viewer.
- Viewer: Ability to view & interact with reports, read data stored in workspace dataflows
- Contributor: Viewer’s permissions, create/edit/delete content in a workspace, publish reports to the workspace, copy reports, utilize report datasets in other workspaces, feature dashboards and reports on others’ Home
- Member: Viewer & Contributor’s permissions, publish, update, and or share an app, allow others to reshare reports, feature apps on others’ Home, add members or additional users with a lower level of access
- Admin: Viewer, Contributor & Member permissions, add/remove users including admins, update and delete the workspace
*Contributors and Viewers can share reports within a workspace if they are given “reshare permissions” when given access to a workspace
**Users can be given “build permission” for a Power BI report dataset if they need to export data and or develop reports in the Power BI Service
When looking to implement Power BI at your organization, it is important to develop a plan and business process for storing, managing, and distributing your Power BI reports. Having documentation around workspaces, users, their access, reasons for access, etc. will allow for long-term success.
Power BI Service is a flexible tool that is highly customizable to your organization’s needs. It provides the opportunity to map it to your current method for report distribution or to develop an entirely new method for improved report distribution & utilization. Whichever route is chosen, it’s important to establish workspaces & preferred sharing methods before Power BI reports are published.
Additional documentation surrounding workspace roles can be found at this Power BI resource.
