the best way to organize workspaces on Power BI (easy to manage but unable to see each other reports

[XhevahirMehalla]

Help is needed:

I have a bank which will embark on using Power BI reports.

I have few users (12) belonging to: Finance, Risk, Operations.

Each user will have its own reports. 

For each respective area will have 1 power bi designer and other people will be consumers of the report.

I will have UAT andf Prod data sources.

How best is to organise this:

One workspace per Area (finance, Risk etc) 

Create Sec Groups and add poeple to Sec Groups.

then do I have to create more workspaces for UAT and Prod for each of these?

I looked into apps but you cannot update them automatically. 

Please suggest what's the best way to do this.

Thanks

[Zanqueta]

Hi @XhevahirMehalla,

Here is a recommended approach to organise your Power BI workspaces for easy management, clear separation, and controlled access:

---

Key Principles

• Isolation by Area: Finance, Risk, and Operations should not see each other’s reports.
• Environment Separation: UAT and Production should be clearly separated to avoid accidental publishing of test data.
• Role-Based Access: Designers and consumers should have distinct permissions.

---

Recommended Structure

1. Create one workspace per area per environment:
   • Finance-UAT
   • Finance-Prod
   • Risk-UAT
   • Risk-Prod
   • Operations-UAT
   • Operations-Prod
   This ensures:
   • Clear separation of environments.
   • No cross-visibility between areas.
   • Easy lifecycle management (UAT → Prod).
2. Use Security Groups for access:
   • Create Azure AD Security Groups for each role:
     • Finance_Designers, Finance_Consumers
     • Risk_Designers, Risk_Consumers
     • Operations_Designers, Operations_Consumers
   • Assign groups to workspaces with appropriate roles:
     • Designers → Member or Contributor
     • Consumers → Viewer
3. Apps for Distribution:
   • Publish an App from each Production workspace for consumers.
   • Apps do not update automatically unless you update the app manually after changes. This is by design in Power BI.
   • UAT workspaces should not have apps for end-users; they are for testing only.

---

Why this approach?

• Scalability: Adding new areas or environments is straightforward.
• Security: Consumers cannot access other areas or UAT data.
• Governance: Clear separation between UAT and Production prevents accidental exposure of test data.

Official References:

Workspaces in Power BI - Power BI | Microsoft Learn

If this response was helpful in any way, I’d gladly accept a 👍much like the joy of seeing a DAX measure work first time without needing another FILTER.

Please mark it as the correct solution. It helps other community members find their way faster (and saves them from another endless loop 🌀.

[XhevahirMehalla]

Thanks, was thinking the same but is difficult to manage them as is a small team and most of the work will be done by two people. 

Can we have one workspace for Env (UAT and PROD) and within each Wrkpsace have many models per Business area and give access to users (sec group)  but not just read access/ is this possible?

[Zanqueta · Accepted solution]

Yes @XhevahirMehalla , it is possible to control access to datasets within a workspace, but there are some important nuances to consider:

---

How dataset access works

• In Power BI, datasets are objects within a workspace, just like reports and dashboards.
• You can assign specific permissions to a dataset using the Manage Permissions option:
  • A user can have access to the workspace but not have permission to use a dataset in their own reports.
  • Alternatively, a user can have permission to use the dataset (Build permission) without having access to the entire workspace.

How to apply this in practice

• In the scenario you described (one workspace per environment with multiple models):
  • Assign Viewer role in the workspace to allow users to view published reports.
  • Grant Build permission only on the datasets that users are allowed to use for creating additional reports.
• This approach provides granular control without the need to create multiple workspaces.

Official Reference:

Semantic model permissions - Power BI | Microsoft Learn

If this response was helpful in any way, I’d gladly accept a 👍much like the joy of seeing a DAX measure work first time without needing another FILTER.

Please mark it as the correct solution. It helps other community members find their way faster (and saves them from another endless loop 🌀.