Forum Discussion
Org vs. Workspace Apps - permissions & embedding
Hi pghMR,
There are two separate behaviours here, and I think it helps to distinguish Org Apps from the existing workspace/classic Power BI apps.
For classic/workspace apps, Microsoft still supports adding Entire organization to an app audience.
Microsoft documents that here: Publish a workspace app in Power BI.
That option can be unavailable in a few cases, for example:
- automatic installation is enabled for the app
- you are a guest user
- your Power BI/Fabric admin has disabled organization-wide app sharing in tenant settings
So if you need true “everyone in the organization” distribution today, a workspace app still supports that pattern.Org Apps use a different access model.
Microsoft’s current Org Apps guidance focuses on granting users/groups access through audiences and sharing the Org App or individual audience items. I do not currently see the same documented Entire organization audience option there.
See: Get started with Org Apps.
For SharePoint, I would not try to embed the complete app experience.
Microsoft’s supported pattern is to embed the individual Power BI report using the Power BI web part in SharePoint Online.
See: Power BI integration with other services.
The report still respects Power BI permissions and RLS, so users only see data they are authorized to see.
So for your rollout, I would currently think about it like this:
Workspace app → best fit if you need Entire organization distribution today Org App → newer app experience with audience-based distribution, but different sharing/embedding capabilities SharePoint → embed individual reports rather than the whole app shellIf your users already use SharePoint as the main navigation portal, one practical approach is to keep the Org App for Power BI consumption but embed the important individual reports into SharePoint where needed.
AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.
Memorable MemberHi pghMR,
Both of those look like current limitations of org apps rather than a setting you are missing (they are still evolving, so worth re-checking the docs' limitations list before rollout). Two practical workarounds so you can still pick org apps:
1. "Entire organization" -> an all-employees group. Create a dynamic Entra ID group that always contains every active employee, and use it as the audience. Membership updates automatically for joiners and leavers:
Entra ID > Groups > New group
Group type: Security
Membership type: Dynamic User
Rule:
(user.accountEnabled -eq true) -and (user.userType -eq "Member")(Dynamic groups need Entra ID P1. If you don't have it, many orgs already have an "All staff" group maintained by HR/IT that you can reuse.)
2. SharePoint -> embed the reports, link to the app. Rather than embedding the app, embed the key report pages with the Power BI web part (or "Embed report > SharePoint Online" link) and add a "Open full app" button that links to the org app. Permissions still flow from the app audience / workspace access, so users only see what they are allowed to.
SharePoint page
-> Power BI web part: Report A (page "Overview")
-> Power BI web part: Report B (page "Summary")
-> Button: "Open the full Sales app" -> org app linkSo my overall approach would be:
Org app as the main distribution channel
-> Audience = dynamic "all employees" group
-> SharePoint = embedded report pages + link to the app
-> Re-check org app limitations as they reach GAAI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.