Forum Discussion
Kudo CommanderPower BI App Audiences vs Workspace Access – Recommended Microsoft Architecture for Production?
Yes, the recommended pattern is exactly that: keep business users out of the workspace entirely and give them access only through the Power BI App. Workspace roles (Admin, Member, Contributor, Viewer) are for the people who build and manage content. The App is the consumer-facing layer, and App Audiences are how you segment which reports each group sees.
If a business user has any workspace role, they can open reports directly from the workspace and completely bypass the App and its audience filters. That is why the separation matters.
On the Contributor visibility issue: Manage Access is only available to Admin and Member roles. It is by design, so a Contributor cannot see or manage membership. Either the workspace Admin owns membership review, or they temporarily promote the developer to Member so they can check.
Practical setup I use in production: Admin/Member for the dev team, no direct workspace access for business users, publish the App, and grant App access per Audience to security groups. Add RLS on the semantic model as a safety net so any audience misconfiguration cannot leak data.
If this helped, a thumbs up and marking it as the solution would be appreciated.
Best,
Shai Karmani
Super UserYes, the recommended pattern is exactly that: keep business users out of the workspace entirely and give them access only through the Power BI App. Workspace roles (Admin, Member, Contributor, Viewer) are for the people who build and manage content. The App is the consumer-facing layer, and App Audiences are how you segment which reports each group sees.
If a business user has any workspace role, they can open reports directly from the workspace and completely bypass the App and its audience filters. That is why the separation matters.
On the Contributor visibility issue: Manage Access is only available to Admin and Member roles. It is by design, so a Contributor cannot see or manage membership. Either the workspace Admin owns membership review, or they temporarily promote the developer to Member so they can check.
Practical setup I use in production: Admin/Member for the dev team, no direct workspace access for business users, publish the App, and grant App access per Audience to security groups. Add RLS on the semantic model as a safety net so any audience misconfiguration cannot leak data.
If this helped, a thumbs up and marking it as the solution would be appreciated.
Best,
Shai Karmani