Disable Sharing Form Personal Workspace

[Anonymous]

Hi Community,

My understanding of best practice in Power BI is to have all shared reports/dashboards in locations that can be managed both from a security perspective as well as a data perspective. Workspaces (especially the new version) is perfect for this as we can assign roles to AD groups and users etc. Whilst I accept the need for personal workspaces & the fact they can not (and should not) be disabled all together is there a way of disabling sharing from them? I am sure I am not theonly one who has come up with this issue, I just can't find a way of effectively managing personal workspaces & so ensuring all data reported on within the company is coming from a known 'trusted' source. failing the ability to restrict sharing is there an inbuilt process for me to manually contact users who have reports so i can monitor their usage?

Thanks in advance for your help

[Greg_Deckler · Accepted solution]

@Anonymous To the best of my knowledge that setting does not exist.

[pvuppala]

Our team finally setup some guard rails to govern these personal workspaces and it seems to work just fine.  Here's how we accomplished it.

• Create an Embedded ASKU capacity
• Move all Personal workspaces from PRO capacity to this ASKU
• Pause the ASKU, that way no one can use it
• We only enable these Personal workspaces for certain individuals on need-only basis by removing them from ASKU 

I used PowerShell script to get this going, been very pleased with this approach.

[Sangeeth]

Amazing! This is such a great workaround. Once the ASKU is paused, do you still get charged for it as it holds all the personal workspaces in there?

[id013]

Hi, we're thinking of utilizing your method in our organization as well. Could you elaborate on the PowerShell script that you used? was it just get\set-powerbiworkspace?  I tried it myself but I'm not a tenant admin and wasn't able to see "my workspace" just the other workspaces I have access to.

[pvuppala]

Here's the sample for those looking to implement this:

1. Gather all personal workspaces to disable and store it as a variable with IDs
2. Batch it up
3. Start the capacity
4. Run AssignWorkpsaces API to bulk move them into this new ASKU (replace it with your Object ID)
5. Pause  the capacity

$Personal_WS = Get-PowerBIWorkspace -All -Scope Organization -Include All  | Where-object { ($_.State -eq "Active") -and ($_.Type -eq "PersonalGroup") -and ($_.Description -ne "SharepointList Folder") -and ($_.isOnDedicatedCapacity -ne "true") }  | Select-Object id

$ToBeDisabled=@()
$guid = $Personal_WS |ForEach-Object {$_.Id}  
$ToBeDisabled = @($guid) + $ToBeDisabled        

# If you have more than 500, you can use to batch it about 500 each time and loop thru the list
$size = 500
$bins = [Math]::Ceiling($ToBeDisabled.count / $size  )

for ($s = 0; $s -le $bins; $s++) {
    $skip = $size * $s 
    $ToBeDisabled_Batch = $ToBeDisabled | Select-Object -First $size -Skip $skip 
    $workspaceIds = @($ToBeDisabled_Batch.id )

    $body = @{
        capacityMigrationAssignments = @(@{
                #targetCapacityObjectId = $targetCapacity.Id;
                targetCapacityObjectId = "YOUR-ASKU-CAPACITY-OBJECT-ID";
                workspacesToAssign     = $workspaceIds
                            
            })
    }
                                
  
    $bodyStr = ConvertTo-Json $body -Depth 3       
                
    Try { 
        Invoke-PowerBIRestMethod -Url 'admin/capacities/AssignWorkspaces' -Method Post -body $bodyStr 
        write-host "$(Get-TimeStamp)    $($ToBeDisabled_Batch.count) Workspaces assigned to capacity (DISABLED): '$($targetCapacity.DisplayName)' " -ForegroundColor Green 
    }
    Catch {
        write-host "$(Get-TimeStamp)    Failed to disable or assign to Embedded A-SKU     " -ForegroundColor Red 
    } 
}
        
write-host "$(Get-TimeStamp) Disabled all $($ToBeDisabled.count) new Personal Workspaces !!" -ForegroundColor Green  

Hope this helps others!

[DavidCousinsT]

You absolute legend!

I'd still rather this was a toggle in the tenant settings as it's going to be a lot of legwork to implement this, but I owe you a beer if I'm now able to stop our 40k users from uploading any old junk into personal workspaces.

[v-angzheng-msft · Accepted solution]

Hi, @Anonymous 

As far as I know there is no such setting, disabling re-share permissions for reports, using row-level security for roles, and publishing an app to specific users might be workarounds.

refer:

Introduction to Workspace in Power BI, Assign Roles and Permission

Row-level security (RLS) with Power BI

Publish an app in Power BI

Best Regards,
Community Support Team _ Zeon Zheng

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Greg_Deckler]

@Anonymous It is deemed a "feature", self-service business intelligence. 😛

[Anonymous]

@Greg_Deckler I'm onboard with self service BI, but this "feature" facilitates the unsolicited sharing of ungoverned reports to report consumers, who are presented with more than one version of the truth and potentially manipulated/falsified data. I don't see how it's a good idea to keep shared content in a personal workspace, especially if that user is on holiday or leaves the company. Shared content should reside in a dedicated shared workspace. This feature allows a backdoor to circumnavigate good data governance.

[Greg_Deckler · Accepted solution]

@Anonymous To the best of my knowledge that setting does not exist.

[felipepaz]

to the date this feteaure exist ?

[pvuppala]

I got excited when I found this post, looking for this exact setting for the same compliance reasons.  Personal workspaces are such a danger when users misuse (even by accident) the conveneinence and ease-of-use.  Microsoft makes it so easy for users it can be a nightmare for administrators.

[Anonymous]

How does everyone manage an environment where more than half of you do not have control over & can't restrict the damage that half can cause?

[ablib]

---

@Anonymous wrote:

How does everyone manage an environment where more than half of you do not have control over & can't restrict the damage that half can cause?

---

It never ceases to amaze me how shortsighted Microsoft can be on some things.  It's like they never have heard of the healthcare or government sectors.

The inability to STOP users from sharing data they shouldn't be, on top of the mess that personal workspaces are, have caused our organization to look for Power BI alternatives.  The cons just keep piling up.