Make users access Reports through an Apps without giving them access to the workspace

[AymericO]

Greetings,

Error description : People that doesn't have access to my Workspace but has been added to the Audience of the App can access the App but there is an Error fetching data for the visual.

Here are some details on the issue I am facing:

• I have a Workspace with an App.
• The Workspace contains all the element that I need (Dataflow Gen2 that put data in my DataLake, they are then interpreted by my Semantic Model and then shown in my Report).
• The Report works and is successfully published in my App.
• People that has access to the Workspace can see the Reports and the related data in the App, but people that doesn't have access to the Workspace but has been added to the Audience of the App can access the App but there is an Error fetching data for the visual.
• When I look at the Permissions in the Semantic Model, I can see people that has access with the Audience having a "App" permissions.
• I checked the box "Install this app automatically" in the App
• EDIT:  My Workspace has a Fabric Capacity lower than F64, all my users got a Power Bi Pro License.

What can I do ?

Best Regards

[v-jingzhan-msft]

Hi @AymericO 

For app consumers, there are two options of license requirements. Reference: Publish an app in Power BI - Power BI | Microsoft Learn

• If the workspace for this app is not in a Power BI Premium capacity: All business users need Power BI Pro or Premium Per User (PPU) licenses to view your app.

• If the workspace for this app is in a Power BI Premium capacity/F64 or higher Fabric capacity: Business users without Power BI Pro or Premium Per User (PPU) licenses in your organization can view app content. However, they can't copy the reports, or create reports based on the underlying semantic models. Read these articles for details:

  • What is Power BI Premium?
  • Microsoft Fabric concepts and licenses

Can you check whether the people that doesn't have access to the Workspace but has been added to the Audience of the App has Power BI Pro or PPU license? Or is the workspace in a F64 or higher Fabric capacity? 

Best Regards,
Jing
Community Support Team

[AymericO]

Hello @v-jingzhan-msft 

Thank for your response,

The Workspace has a Fabric capacity lower that F64, all the user got a Power BI Pro license.

Best Regards,

Aymeric

[v-jingzhan-msft · Accepted solution]

Hi  @AymericO 

Thank you for this information. Does the user receive the following error?  

When your report is based on a Direct Lake semantic model, you need to perform some additional settings to ensure that report users can view the relevant data in the report. Besides the App permission on the semantic model you observed, report users also need to access the source Fabric item. 

For a Direct Lake semantic model, there are two account options to access the source Fabric item. The account used to access data is one of the following.

• If the cloud connection uses SSO (default), it is the report consumer.
• If the cloud connection uses a fixed identity, it is the fixed identity.

The account must at least have Read and ReadData permissions on the source item (lakehouse or warehouse). Item permissions can be inherited from workspace roles or assigned explicitly for the item as described in this article.

As the default option is using SSO, the report in the App uses the report users' accounts to access the source Lakehouse SQL Endpoint. This leads to the error for users that don't have access to the Workspace. To resolve this, you can go to Manage permissions of the related lakehouse to share the permission with the users. 

I'm testing a new semantic model, so I have to choose "Read all SQL endpoint data". For a default semantic model, it seems you don't need to select additional permissions according to the annotation. I haven't tested it yet, to be honest. 

After sharing the lakehouse with the users, you will see these users have Read permission on the lakehouse. Go to Manage permissions of the related SQL endpoint of the lakehouse, you will see they haveRead and ReadData permissions. Now the users should be able to see data in the visuals. 

However this sharing will allow users to access the source Fabric items directly. If you don't like this and want the users to only access the semantic model, please use a fixed identity instead of SSO. 

For more details and guidance, please read the following articles:

Develop Direct Lake semantic models - Microsoft Fabric | Microsoft Learn

Manage Direct Lake semantic models - Microsoft Fabric | Microsoft Learn

Learn how to specify a fixed identity for a Direct Lake semantic model in Power BI and Microsoft Fab...

Best Regards,
Jing
If this post helps, please Accept it as Solution to help other members find it. Appreciate your Kudos!

[AymericO]

Hello,

I works ! I resolve the issue.
But, one more question, by doing this you allow your user to have access to all data, However, I only want my users to have access to the data I want to show them, with a specific filter. Is there another solution? A workaround would be to have two data sources, one with the raw data, then a second with the pre-filtered data, and the report would only have access to the second source... What do you think?

[v-jingzhan-msft]

Hi @AymericO 

In that case, using a fixed identity is more recommended. Go to the semantic model's settings page to modify the authentication type. Follow steps in Learn how to specify a fixed identity for a Direct Lake semantic model in Power BI and Microsoft Fab...

Best Regards,
Jing

[DemoFour]

Morning @AymericO 

Have a look at this learn article Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn

That should help you in your output. 

[DemoFour]

@AymericO Are you the tenant Admin?  Are you publishing into a premium workspace that has been set up to distribute to the organisation? 

[DemoFour]

@AymericO What licencing SKU are you running your tenant on? 

[AymericO]

@DemoFour  The Current license on the workspace is: Fabric capacity