App Audience Permissions Vs. Dataset Permissions when dataset shared across workspaces

[lucasdhilsbos]

We have an app whose contents include a report with a source semantic model that is shared from another workspace. It appears that in that case users must have view permission for the dataset in addition to being in the appropriate app audience. Is this expected/intended behavior? I am curious if others see this as a drawback to semantic model-workspace sharing being utilized or if they just add the view permissions as needed and are comfortable with that solution.

[v-pnaroju-msft · Accepted solution]

Hi lucasdhilsbos,

Based on our understanding, when a report in an app connects to a semantic model hosted in a different workspace, app audience permissions provide access to the report only. Access to the underlying semantic model must be granted separately in the source workspace. In cross workspace scenarios, users must have the appropriate permissions on the semantic model, such as Read or Build, in addition to app access.

For user error and permission inconsistencies, placing the semantic model and report within the same workspace is a good approach for simpler scenarios. In such cases, app permissions may be sufficient and help avoid the need for managing permissions in two places. However, keeping the semantic model in a separate workspace is also a valid and commonly used enterprise practice for reuse and governance. In that case, it is best practice to use the same security group for both the app audience and the semantic model permissions. This ensures consistency and helps prevent manual errors.

Additionally, kindly refer to the links below:
Publish an app in Power BI - Power BI | Microsoft Learn
Semantic model permissions - Power BI | Microsoft Learn
Build Permission for Shared Semantic Models - Power BI | Microsoft Learn

We hope the information provided helps resolve the issue. Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.

Thank you.

[v-pnaroju-msft]

Thankyou, @cengizhanarslan and @tmhalila for your responses.

Hi lucasdhilsbos,

We appreciate your inquiry through the Microsoft Fabric Community Forum.

We would like to inquire whether have you got the chance to check the solutions provided by @cengizhanarslan and @tmhalila to resolve the issue. We hope the information provided helps to clear the query. Should you have any further queries, kindly feel free to contact the Microsoft Fabric community.

Thank you.

[tmhalila]

True, I also see this as a drawback, and what I usually try to consider is just to add a Link of report from the other workspace of the other user, through it will display a new Tab in your Power BI App not within the same panel as reports of your own workspace. @lucasdhilsbos 

So, the solution here is just add that link of the dashboard within your Power BI App, it is enough as the aim is to view a report/dashboard.

[cengizhanarslan]

App permissions are scoped to the app workspace. The semantic model lives in a separate workspace entirely, so Power BI treats it as an external resource from the app's perspective. Meaning that yes users also need at least Read permission on the semantic model in the source workspace. 

[lucasdhilsbos]

Would this motivate you to place the semantic model in the same workspace as the report/app to avoid having to assign permissions in both places? My concern is user error and inconsistency in semantic model vs app permissions that need to overlap. Do you agree that this is avoided by placing semantic model and report in the same workspace/app?