Power BI – How to restrict access to reports using folders within a single workspace

[Ramkishor]

Hello @Everyone ,

I currently have multiple Power BI workspaces, but for governance and maintenance reasons, I want to move to a single workspace model.

My requirement is:

• Use one single workspace

• Organize reports using folders (e.g., Accounts Payable, Accounts Receivable, GL, etc.)

• Ensure that users can only see reports relevant to their role

  • For example:

    • Accounts Payable users should only see Accounts Payable folder reports

    • Accounts Receivable users should only see AR folder reports

• Users should not be able to see reports from other folders

I understand that folders help with organization of the reports , not to provide access to the reports.

Questions:

What is the recommended Microsoft-supported approach to achieve this requirement?

Looking for best practices and real-world recommendations.

Thanks in advance!

Regards,
RamaKishor.

[MohitsinghMS · Accepted solution]

To achieve this in a single workspace, you must use Power BI Apps with Multiple Audiences.

Folders provide organization, but App Audiences provide the security.

The Solution: Power BI App Audiences

1. Keep Users Out of the Workspace: Do not give end-users "Viewer" roles in the workspace. If you do, they will see every folder and report.

2. Create the App: In your workspace, click Create/Update App.

3. Define Audiences: Create tabs for each group (e.g., "AP Group," "AR Group").

4. Toggle Visibility:

• Select the AP Audience tab and "hide" all AR/GL reports using the eye icon.

• Select the AR Audience tab and "hide" all AP/GL reports.

5. Assign Access: Add the specific Security Group (e.g., SG_AccountsPayable) to its corresponding Audience tab.

[Ramkishor · Accepted solution]

Thanks @MohitsinghMS for the explanation on using Power BI Apps with multiple Audiences — that makes sense.

I have one more related question regarding environments.

Currently, I have:

• One workspace for Test (UAT) with respective folders and reports

• One workspace for Production with respective folders and reports

I need to provide:

• Business users access to Production

• Selected users (UAT testers / key users) access to the Test environment as well(Ex: Accounts receivable user only access accounts receivable related reports etc..)

Questions:

1. Do we need to create a Power BI App for the Test workspace also, similar to Production?

2. What is the recommended best practice to handle this secnario

Thanks in advance!

[AshokKunwar · Accepted solution]

Hii @Ramkishor 

​The Microsoft-recommended approach for this is to use a single workspace to develop your reports, but distribute them via a Power BI App using Multiple Audiences. This allows you to create different "views" of the same app for different groups of people.

​Step 1: Organize your Workspace

​Upload all your reports (AP, AR, GL) into your single workspace. You can still use folders to keep the workspace clean for the developers/admins.

​Step 2: Create the App and Define Audiences

1. ​Click Create App (or Update App) in your workspace.
2. ​Go to the Content tab and add all the reports.
3. ​Go to the Audience tab. Here is where the "Security" happens:
   • ​Create a new Audience named "Accounts Payable".
   • ​Select only the AP reports to be visible (click the "eye" icon to hide the others).
   • ​In the Manage Audience Access pane, add the AP security group or specific users.
4. ​Repeat this for "Accounts Receivable" and "GL".

​Step 3: Manage Workspace Access

• ​Important: Do not add the end-users (AP/AR staff) as "Viewers" of the workspace itself.
• ​Keep only developers as Members/Contributors.
• ​End-users will access the reports via the App URL. Because they are only in the "AP Audience," they will never even see the "AR" or "GL" tabs in their navigation menu.

​Best Practices & Real-World Recommendations

• ​Use Security Groups: Instead of adding individual users to Audiences, use Entra ID (Active Directory) Security Groups. This makes maintenance much easier as people join or leave the company.
• ​Semantic Model Security (RLS): If you have one giant dataset powering all reports, ensure you also implement Row-Level Security (RLS). This ensures that even if someone accidentally gets a link to the wrong report, they won't see the underlying data.
• ​App Limit: Remember that you can have up to 25 audiences per app, which is usually plenty for a single-workspace model.

​Why this is the "Best Practice":

• ​Centralized Maintenance: You only manage one workspace and one set of semantic models.
• ​Professional UX: Users get a clean, branded portal (the App) instead of the messy workspace list.
• ​Security: Users only see what they are explicitly permitted to see.

​Summary for the Community

​Folders are for developers to organize work; Apps with Audiences are for users to consume content securely. If you want a single-workspace model with restricted visibility, the App Audience feature is the native Microsoft-supported solution.

​If this architecture helps you consolidate your workspaces securely, please mark this as the "Accepted Solution"!

[AshokKunwar]

Hii 👋 @Ramkishor 

If this architecture helps you consolidate your workspaces securely, please mark this as the "Accepted Solution"!

[AshokKunwar · Accepted solution]

Hii @Ramkishor 

​The Microsoft-recommended approach for this is to use a single workspace to develop your reports, but distribute them via a Power BI App using Multiple Audiences. This allows you to create different "views" of the same app for different groups of people.

​Step 1: Organize your Workspace

​Upload all your reports (AP, AR, GL) into your single workspace. You can still use folders to keep the workspace clean for the developers/admins.

​Step 2: Create the App and Define Audiences

1. ​Click Create App (or Update App) in your workspace.
2. ​Go to the Content tab and add all the reports.
3. ​Go to the Audience tab. Here is where the "Security" happens:
   • ​Create a new Audience named "Accounts Payable".
   • ​Select only the AP reports to be visible (click the "eye" icon to hide the others).
   • ​In the Manage Audience Access pane, add the AP security group or specific users.
4. ​Repeat this for "Accounts Receivable" and "GL".

​Step 3: Manage Workspace Access

• ​Important: Do not add the end-users (AP/AR staff) as "Viewers" of the workspace itself.
• ​Keep only developers as Members/Contributors.
• ​End-users will access the reports via the App URL. Because they are only in the "AP Audience," they will never even see the "AR" or "GL" tabs in their navigation menu.

​Best Practices & Real-World Recommendations

• ​Use Security Groups: Instead of adding individual users to Audiences, use Entra ID (Active Directory) Security Groups. This makes maintenance much easier as people join or leave the company.
• ​Semantic Model Security (RLS): If you have one giant dataset powering all reports, ensure you also implement Row-Level Security (RLS). This ensures that even if someone accidentally gets a link to the wrong report, they won't see the underlying data.
• ​App Limit: Remember that you can have up to 25 audiences per app, which is usually plenty for a single-workspace model.

​Why this is the "Best Practice":

• ​Centralized Maintenance: You only manage one workspace and one set of semantic models.
• ​Professional UX: Users get a clean, branded portal (the App) instead of the messy workspace list.
• ​Security: Users only see what they are explicitly permitted to see.

​Summary for the Community

​Folders are for developers to organize work; Apps with Audiences are for users to consume content securely. If you want a single-workspace model with restricted visibility, the App Audience feature is the native Microsoft-supported solution.

​If this architecture helps you consolidate your workspaces securely, please mark this as the "Accepted Solution"!

[MohitsinghMS · Accepted solution]

To achieve this in a single workspace, you must use Power BI Apps with Multiple Audiences.

Folders provide organization, but App Audiences provide the security.

The Solution: Power BI App Audiences

1. Keep Users Out of the Workspace: Do not give end-users "Viewer" roles in the workspace. If you do, they will see every folder and report.

2. Create the App: In your workspace, click Create/Update App.

3. Define Audiences: Create tabs for each group (e.g., "AP Group," "AR Group").

4. Toggle Visibility:

• Select the AP Audience tab and "hide" all AR/GL reports using the eye icon.

• Select the AR Audience tab and "hide" all AP/GL reports.

5. Assign Access: Add the specific Security Group (e.g., SG_AccountsPayable) to its corresponding Audience tab.

[Ramkishor · Accepted solution]

Thanks @MohitsinghMS for the explanation on using Power BI Apps with multiple Audiences — that makes sense.

I have one more related question regarding environments.

Currently, I have:

• One workspace for Test (UAT) with respective folders and reports

• One workspace for Production with respective folders and reports

I need to provide:

• Business users access to Production

• Selected users (UAT testers / key users) access to the Test environment as well(Ex: Accounts receivable user only access accounts receivable related reports etc..)

Questions:

1. Do we need to create a Power BI App for the Test workspace also, similar to Production?

2. What is the recommended best practice to handle this secnario

Thanks in advance!

[MohitsinghMS]

Hi @Ramkishor , 

Yes, create an App for both. Using an App for UAT ensures testers see exactly what the final users will see, without giving them "behind-the-scenes" access to your workspace drafts.

Best Practice Setup

1. Use App Audience Groups

Don't create separate workspaces for every department. Inside your Production App, use the Audiences feature:

• AR Audience: Assign Accounts Receivable reports here. Grant access only to the AR Team.

• Sales Audience: Assign Sales reports here. Grant access only to the Sales Team.

• Result: Users only see the tabs/reports they are authorized to view within a single App.

2. Access Control

• Workspace: Keep this restricted to Developers only.

• App: This is for Business Users. Grant "Viewer" access via Security Groups (e.g., SG_UAT_Testers for the Test App and SG_Finance_Users for the Prod App).

3. Deployment Pipelines

If you have Premium/Fabric, use Deployment Pipelines. This lets you "push" reports from Test to Production instantly while automatically swapping "Test" data sources for "Production" data sources.

[Idrissshatila · Accepted solution]

Helllo @Ramkishor ,

1 / 2 - if you want to show some testers specific reports in the testing workspace and other testers other reports then Yes you need to make it an APP as well.

while if the testers can see all reports in the testing workspace then just give them access to the workspace.