Forum Discussion
Power BI Apps - Audience seems not enough & Power BI REST API doesn't support direct read assignment
Hi lachicazul,
Thankyou for the followup.
As per my understanding, you do not need to grant Viewer access to the workspace for all 1,000 users. The confusion appears to arise because report level Read permissions are lost on redeploy. However, App access operates differently. Users can consume reports through the App without being workspace members.
Please find below the purpose and benefits of using an App:
- Apps are designed to distribute content to large audiences securely without granting them access to the workspace.
- Add your Entra (AAD) groups directly as App audiences, this allows users to view reports in the App while keeping the workspace restricted to developers.
- Use workspace roles (Admin/Member/Contributor/Viewer) only for creators or CI/CD automation, not for end users.
- The App serves as the managed consumption layer. Workspace access should remain limited.
- This approach preserves security and scalability while supporting clear governance.
We hope the information provided will help resolve the issue. Should you have any further queries, please feel free to contact the Microsoft Fabric community.
Thank you.
Hi again,
Unfortunatelly, the description above doesn't work. As explained, this is our current setup:
We have implement this security architecture for a specific Entra Group X:
XXX-SemanticModels Workspace: None
Sales Semantic Layer: Read, Build
XXX-Sales Reporting Workspace: none
XXX-Sales App: part of the Audience
Report level: Read
If we remove this permission: "Report level: Read" the users cannot see the reports in the App.
So we are still in square 0