Creating multiple Audiences in PowerBI App

[Gokul_PBI]

Hi Everyone,

We have multiple groups that will be using the Power BI App we created (e.g., Finance, Admin (PBI), Report Consumers, etc.).

I noticed that there is an option to create multiple audiences in the app. However, all users who will be using the app are already part of the workspace with one of the available roles.

My question is: What exactly does “Workspace users” mean in this context? Unlike other users/groups that I added manually (where I see an option to delete), the workspace users appear by default, and I don’t see any option to remove them.

Does this mean I cannot restrict app access for users who already have access to the workspace?

[v-achippa]

Hi @Gokul_PBI,

Thank you for reaching out to Microsoft Fabric Community.

Thank you @MasonMA and @tayloramy for the prompt response.

As we haven’t heard back from you, we wanted to kindly follow up to check if the solution provided by the user's for the issue worked? or let us know if you need any further assistance.

Thanks and regards,

Anjan Kumar Chippa

[v-achippa]

Hi @Gokul_PBI,

We wanted to kindly follow up to check if the solution provided by the user's for the issue worked? or let us know if you need any further assistance.

Thanks and regards,

Anjan Kumar Chippa

[tayloramy]

Hi @Gokul_PBI, 

@MasonMA is 100% on the ball here. Anyone with workspace access is automatically a member of all audiences in an app. 

If your goal is just to share reports with specific audiences, just do that through the app, don't add any item level permissions. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution. 

[Gokul_PBI]

In that case should we just share semantic model without adding user to workspace?or even that is not needed if we add to app?

[MasonMA · Accepted solution]

For typical report users, we should not add them to the workspace and usually should not share the semantic model directly. Sharing the semantic model will allow them to build new reports, which most report consumers should not do. 

Only if some of your users are BI developers or users who build their own reports, you would need to grant them Build permission on the semantic model. 

[MasonMA]

Anyone who is a member of the workspace automatically sees the app.

If in this situation, I'd not add users to the workspace at all. Instead, I'd only give them app-level permissions and add them to specific audiences. 

[Gokul_PBI]

Question 1:
Will users be able to see the underlying data if I only share the app without sharing the semantic model?

Question 2:
If I have Row-Level Security (RLS), how will that work if I only share the app without sharing the semantic model?

[tayloramy]

Hi @Gokul_PBI 

1: read access is granted as part of the app. You can also grant reshare and build permissions under the advanced tab when editing an audience. 
2: Apps respect RLS unless the app is using a service principal as an effective identity, in which case everyone sees what the service principal can see. 

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.