Forum Discussion

Marc_B's avatar
Marc_B
Icon for Helper I rankHelper I
5 months ago
Solved

Cross‑workspace shared dataset: users must open App A before accessing App B — How to Fix?

Hello,

I have created a report, which I will call “A”, in a workspace and granted Build permission to a colleague through the app audience settings.

He then created his own report, which I will call “B”, by directly querying the model behind report A. He stored it in a different workspace and created his own app for it.

The app that contains report A has been shared with the entire organization, which prevents me from enabling its automatic installation.

The issue is that whenever a new user is granted access to the app that contains report B, they cannot access it until someone first directs them to the app containing report A. After opening that one, the user can then successfully access the app for report B.

As you can see, this process is not very smooth and I would like to fix it.

I have tried sharing the dataset and granting Build permission to the developer of report B, but the issue still persists. My questions are:

  • If I delete the app that contains report A, will the model underlying report B stop working?
  • Is there a better way to resolve this problem?

Thanks

Need Help
  • Marc_B's avatar
    Marc_B
    5 months ago

    Hi v-aatheeque ,

    I've just unpublished the app A. So, automatically, the read+build permissions given through the app were translated into grants for the dataset.

    Thanks for your support

14 Replies

  • Murtaza_Ghafoor's avatar
    Murtaza_Ghafoor
    Icon for Super User rankSuper User
    5 months ago

    Marc_B 

    Solution to this problem:

    Go to Workspace A → Dataset (Semantic Model)
    Grant users:

    • Read permission
    • (Optional) Build permission if they need to create reports

    ✔ This removes dependency on opening App A
    ✔ Users can directly open Report B without issues


    More Practical Approach

    Instead of managing individuals:

    • Create an Azure AD / Entra ID security group
    • Add users there
    • Grant that group:


    Access to Dataset in Workspace A

    Access to App B

    ✔ Clean
    ✔ Scalable
    ✔ Enterprise-grade approach

    If this helps, ✓ Mark as Kudos | Mark as Solution| Help Others

  • Marc_B's avatar
    Marc_B
    Icon for Helper I rankHelper I
    5 months ago

    Hi Murtaza_Ghafoor ,

    thanks for your support.
    I’m not sure I can follow your advice, since I need App B to be shared with the entire organization. Everyone needs to be able to view it.
    Thanks
    • v-aatheeque's avatar
      v-aatheeque
      Icon for Community Support rankCommunity Support
      5 months ago

      Hi Marc_B 
      Murtaza_Ghafoor  Thanks for your prompt response ,In addition to that 

      Even if App B is shared with the entire organization, access to the underlying dataset (in Workspace 1) is not automatically granted. Opening App A works because it provides users with the required dataset access.

      Deleting App A will not break the dataset itself, but users will lose that implicit access, and Report B may stop working for them.

       

      To support org-wide access to App B, you’ll need to either :

      • Keep App A published (as it enables dataset access) or
      • Grant organization wide permissions directly on the dataset (if allowed).

      Note : Microsoft recommends centralizing datasets in a dedicated workspace and granting permissions there, so reports in other workspaces can be shared without dependency on another app.

       

      Reference : Build Permission for Shared Semantic Models - Power BI | Microsoft Learn

      Introduction to Semantic Models Across Workspaces - Power BI | Microsoft Learn

       

      Hope this helps!!

      Thank You.

      • Marc_B's avatar
        Marc_B
        Icon for Helper I rankHelper I
        5 months ago

        Hi v-aatheeque ,

        thanks for your support. Maybe I didn’t fully understand your answer, so I’d like to clarify that Report A is shared (granting Build permission) with the specific user who developed Report B.
        By checking the Manage Permissions panel of Dataset A, I can confirm that it is shared with the entire organization through the app audience setup, and it seems I cannot add the entire organization also as a user separate from the app audience in this panel.

        Thanks