Allow Users to see a report, but not the Tables/SQL of the underlying Warehouse

[Martijn1204]

Hello everyone.

Currently we have a report with the following lineage:
Gold Warehouse --> Semantic Model --> PBI Report
We would like users to see the content in the PBI report, but not the underlying data from the Warehouse.

Initially, we tried changing the permissions of the Warehouse.

If we manage the permissions for users of the gold warehouse itself, ReadAll, visuals in the report do not load and return the following error:

When the permission is set to ReadData, visuals show up as expected, but users are still able to access the warehouse through the View semantic model, and the through the related Gold Warehouse:

After selecting this, users are able to see the following option, giving them access to all underlying data:

If users are added to the workspace of the Warehouse as a viewer instead, this option does not appear, but they would still be able to see through the workspace.

Is there any way to not allow users to see the content of the Warehouse and only the report itself?

Thank you in advance for any help.

[ibarrau]

Hi. If I have to do that I think my first guess would be removing any permission of the user at the workspace or item. Then create a Power Bi App with the report/s that want to share with them. Add the user/group as audience for the specific report you want to share. I don't think they would get access to warehouse like that. They only have Power Bi App permission with a report as audience.

I hope that helps,

[Martijn1204]

Thank you for your reply.

If I understand correctly, this results in the report and the warehouse being in separate workspaces (which is the case here).
I have checked and made sure access to both the report and semantic model is set to view/read, but the "Couldn't Load Data for this Visual"-error seems to appear unless we grant access to the warehouse (or its workspace) in some way as well.

[ibarrau · Accepted solution]

No. It's a single workspace. Unless you have a requirement for keeping different workspaces, you can use only one. I was talking about a single one. The Power Bi App is an abstraction of a single workspace and lets you share in a different way, it doesn't create a second workspace.

https://learn.microsoft.com/en-us/power-bi/consumer/end-user-apps

Regards

[Martijn1204]

Thank you for your explanation.
Just to clarify; the report is in an app, but viewers are still able to access the Gold Warehouse indirectly (via the method displayed in the original post).
Since the elipses are also in the app, they can view the semantic model, and therefore the Gold Warehouse. If they do not have any permissions to the Gold Warehouse, the "Couldn't Load Data for this Visual"-error appears.