How to Restrict Access to Only PROD Reports When Dev & Prod Are in the Same Workspace?

Hi manoj_0911 

In our company, across thousands of premium workspaces, we don't allow end users access to the workspace. Instead, we build Apps specific to end-user audience population.

If you're on a Fabric workspace, you can create 1 org App for production and share it with the relevant audience through security group(s), and then you can create 1 org App for development for testing purposes.

Alternatively, you can do the same with the legacy App experience using Audiences.

This prevents unauthorized consumption and keeps the workspace tidy for those that are truly contributors.

Hi manoj_0911 ,

Currently to my knowledge there is no option to limit the acces to folders specifically so if you have the PROD and DEV inside the same workspace you have no option to make the user in the workspace but hide the dev reports.

The only way I see is if you create an app and then you can limit wich reports that specific user can see inside the app without the need to give them access to the workspace.

https://learn.microsoft.com/en-us/power-bi/explore-reports/end-user-apps
https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-create-distribute-apps

Hi manoj_0911 ,

there are two options. Both options require that the customers Azure AD group has no direct access to the workspace:

1) Open the item list of your workspace and open the context menu of the report you want to share access to. Choose "Manage Permissions" then and add the customer AD group to the people who have "Direct Access"

2) Create a Power BI App in Power BI Services, add all the reports your customer should see and add the appropriate access rights

Hope, that helps...

Unfortunately, Power BI does not support item-level security inside a workspace. Permissions in a workspace apply to the entire workspace, not to specific folders or reports. So if you grant a customer Azure AD group access to the workspace (Viewer/Member/Contributor), they will be able to see all reports in that workspace, regardless of folders such as DEV and PROD. Those folders are only organizational and do not enforce security boundaries.

Recommended approach:

Separate DEV and PROD workspaces, for example:

• Reporting – Dev
• Reporting – Prod

Then:

• Internal team → access to Dev + Prod

• Customer Azure AD group → access only to Prod

This also aligns with standard deployment pipeline practices (Dev → Test → Prod), which Microsoft recommends for lifecycle management.

Publish your reports to a workspace app and don't give them role to the workspace. You can create different audiences and assign an AD group to one or more of the audiences.  Another  approach is to give them direct access to the reports but this can become a maintenance nightmare.