Power BI Service - Restrict access within Workspace

[Krp]

Hello,

I am trying to  restrict our Productionised Workspace. Microsoft has Member/Contributor accesses pretty much similar rights apart from some minor difference.  Either it is wide open or it is too restricted, Microsoft doesnt offer anything in between. 

What i want to achieve is in our prod workspace,

- Let users to download .pbix files but not to have "Edit" or "save"( overwrite ) access

- Let them "save as" but only into their own workspace and not into prod workspace

- let them have access to "Dataset" to create their own report copies

Note: we are not using Apps and dont want to go that path. We want to stick to direct workspace access.

Is there any solution to my need? 

Thanks a lot.

Krp

[Hariharan_R]

Hi @Krp 

Please check below.

- Let users to download .pbix files but not to have "Edit" or "save"( overwrite ) access. Download is possible only with Contributor access. if you dont want to allow edir then you need to maintain the PBIX files somewhere in your repository like sharepoint and provide access to users to download. I guess we dont have option to restrict only download option.

- Let them "save as" but only into their own workspace and not into prod workspace - This is again available with contributor. if you dont want to do the same without edit then download the PBIX and publish it to my workspace.

- let them have access to "Dataset" to create their own report copies - Provide build permission to the dataset. It will allow them to create reports.

Thanks

Hari

Did I answer your question? Then please mark my post as the solution.
If I helped you, click on the Thumbs Up to give Kudos.

My Blog :: YouTube Channel :: My Linkedin

[Krp]

Hello @Hariharan_R ,

Thank you for your response.

But it is not solution to my issue. I did give users direct build access to Data Set but then it doesnt make them save it into their own workspace.

Same for Power Users issue where i want to allow them to save copy but not into prod workspace.

These are basic security things anyone would want for productionised reports , wondering why microsoft doesnt offer straight forward solution to this !!

Basically, all i can either have Apps for each workspace or create separate workspace for self service which can be dumping ground for users when they create their own reports from published data set. And am sure i cant set up automated deletion process for that dump ground when users are not using those reports.

I wish Msft can come up with some simple solution for such things.

[Hariharan_R]

Hi @Krp 

Creating seperate workspace for self service activities for users without disturbing the production WS is the best approach and simple. 

You can use Power BI REST apis to monitor the workspace usage or use workspace usage metrics report to see the usage and then if it not being used then you can delete it through REST API in case if you want to automate.

Thanks

Hari

Did I answer your question? Then please mark my post as the solution.
If I helped you, click on the Thumbs Up to give Kudos.

My Blog :: YouTube Channel :: My Linkedin