Power BI Embedded

[p_da]

Hey all,

I have the following scneario. I have a user, lets call it User A. User A has build permission in a dataset that is available in the workspace A. 

I am implemeting a embedded solution, where can create a new blank report from the dataset in workspace A. The embedded I'm using is your organization. That being said, I am facing issues with the permissions. I can only save the report in a workspace B, if the user has contributor in the workspace A. 

Is that right ?

[v-priyankata]

Hi @p_da 
I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please Accept it as a solution and give it a 'Kudos' so others can find it easily.
Thank you.

[v-priyankata]

Hi @p_da 
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.

[v-priyankata]

Hi @p_da 

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[v-priyankata · Accepted solution]

Hi @p_da 
Thank you for reaching out to the Microsoft fabric community forum and kudos to @johnbasha33 for their helpful input.

I understand you're using Power BI Embedded (App-Owns-Data) and want User A, with only Build permission on a dataset in Workspace A, to create a report and save it to their Personal Workspace using Save As, without needing Contributor role in Workspace A due to security concerns (e.g., RLS bypass). The authorization error occurs because Power BI requires write permissions (like Contributor) in Workspace A for cross-workspace saves, unless specific configurations are applied.

Use a Certified/Promoted Dataset with Tenant Settings this allows User A to save reports to their Personal Workspace with only Build permission.

• In Workspace A, go to the dataset, click the three-dot menu, select “Settings,” and mark it as Promoted (if you have permissions) or request Certification from your admin.
  
  
• Ask your tenant admin to enable “Allow users to connect to and build on datasets across workspaces” in the Power BI Admin Portal (Tenant settings > Export and sharing settings > Use datasets across workspaces) and Confirm User A has Build permission on the dataset in Workspace A (via “Manage Permissions”).
  
  
• User A creates a report in the embedded solution and uses Save As to save it to their Personal Workspace. This should now work without errors.

If this post helps, then please give us ‘Kudos’ and consider Accept it as a solution to help the other members find it more quickly.
Thank you.

[johnbasha33]

@p_da 

In Power BI:

• Build Permission ➔ lets you connect to a dataset and create reports in Desktop or adhoc in Service.

• Saving a report BACK to a workspace requires:

  • Write permissions in the dataset’s workspace (like Contributor role),

  • or the dataset must be Certified or Promoted (depending on tenant settings) + Allow "Save As" to other workspaces.

or you publish your report into a workspace where the dataset is already linked/shared

In your case:

• Build permission alone is enough to create the report live.

• But when you try to SAVE the report into a different workspace (Workspace B) ➔ Power BI Service still checks if you have rights to the underlying dataset.

• Since the dataset lives in Workspace A ➔ and your report depends on it, Power BI enforces stricter control.

So Contributor on Workspace A is needed by default.

Ways to get around this:

1. Add User A as a Contributor to Workspace A.

   (Simple, but not always ideal if you don't want too much access given.)

2. Use a Shared Dataset correctly:

   • If Dataset A is already certified/promoted, then allow Workspace B to directly connect to Dataset A without needing high workspace permission.

   • Then save reports to Workspace B freely.

   (Requires Tenant setting ➔ "Allow users to connect to and build on datasets across workspaces")

3. Use Deployment Pipelines or Linked Datasets:

   • Create a linked dataset from A to B (using Power BI Datamarts or Power BI Service itself).

   • Then build new reports off the linked dataset in Workspace B directly.

4. Dataset Endorsement (optional):

   Did I answer your question? Mark my post as a solution! Appreciate your Kudos !!

Certify or Promote Dataset A ➔ which relaxes some security barriers if your tenant settings allow it.

[p_da]

Thanks for replying.

Even trying what you said, still can´t save the report. 

Just a note, a Im trying to use the embedded solution, not creating the report via the PowerBI Service.

My goal basically is, to have a workspace A, where the dataset will be hosted. Users will have only build permission on that dataset, so no contributor at all.

So while using the PowerBI Embedded solution, what I need is the following:

* Users crate a report from the dataset that is hosted in the workspace A (Users will have build permission) and then, when use click in the SaveAs button in the embedded solution, the report must be saved to users Personel workspace.

The problem that I'm having is, even with the build permission in the dataset and saving the report to user's workspace, it is giving error regarding authorization. However, if I add the user as contributor to the workspace A, user can save the report. However assiging user as contributor, is not feasible for security concerns.

Thanks