Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Get certified in Microsoft Fabric—for free! For a limited time, get a free DP-600 exam voucher to use by the end of 2024. Register now

Reply
Anonymous
Not applicable

Disable Sharing Form Personal Workspace

Hi Community,

 

My understanding of best practice in Power BI is to have all shared reports/dashboards in locations that can be managed both from a security perspective as well as a data perspective. Workspaces (especially the new version) is perfect for this as we can assign roles to AD groups and users etc. Whilst I accept the need for personal workspaces & the fact they can not (and should not) be disabled all together is there a way of disabling sharing from them? I am sure I am not theonly one who has come up with this issue, I just can't find a way of effectively managing personal workspaces & so ensuring all data reported on within the company is coming from a known 'trusted' source. failing the ability to restrict sharing is there an inbuilt process for me to manually contact users who have reports so i can monitor their usage?


Thanks in advance for your help

2 ACCEPTED SOLUTIONS
Greg_Deckler
Super User
Super User

@Anonymous To the best of my knowledge that setting does not exist.



Follow on LinkedIn
@ me in replies or I'll lose your thread!!!
Instead of a Kudo, please vote for this idea
Become an expert!: Enterprise DNA
External Tools: MSHGQM
YouTube Channel!: Microsoft Hates Greg
Latest book!:
Power BI Cookbook Third Edition (Color)

DAX is easy, CALCULATE makes DAX hard...

View solution in original post

v-angzheng-msft
Community Support
Community Support

Hi, @Anonymous 

 

As far as I know there is no such setting, disabling re-share permissions for reports, using row-level security for roles, and publishing an app to specific users might be workarounds.

 

refer:

Introduction to Workspace in Power BI, Assign Roles and Permission

Row-level security (RLS) with Power BI

Publish an app in Power BI

 

 

Best Regards,
Community Support Team _ Zeon Zheng


If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

View solution in original post

13 REPLIES 13
pvuppala
Helper IV
Helper IV

Our team finally setup some guard rails to govern these personal workspaces and it seems to work just fine.  Here's how we accomplished it.

  • Create an Embedded ASKU capacity
  • Move all Personal workspaces from PRO capacity to this ASKU
  • Pause the ASKU, that way no one can use it
  • We only enable these Personal workspaces for certain individuals on need-only basis by removing them from ASKU 

I used PowerShell script to get this going, been very pleased with this approach.

Amazing! This is such a great workaround. Once the ASKU is paused, do you still get charged for it as it holds all the personal workspaces in there?

Hi, we're thinking of utilizing your method in our organization as well. Could you elaborate on the PowerShell script that you used? was it just get\set-powerbiworkspace?  I tried it myself but I'm not a tenant admin and wasn't able to see "my workspace" just the other workspaces I have access to.

Here's the sample for those looking to implement this:

  1. Gather all personal workspaces to disable and store it as a variable with IDs
  2. Batch it up
  3. Start the capacity
  4. Run AssignWorkpsaces API to bulk move them into this new ASKU (replace it with your Object ID)
  5. Pause  the capacity
$Personal_WS = Get-PowerBIWorkspace -All -Scope Organization -Include All  | Where-object { ($_.State -eq "Active") -and ($_.Type -eq "PersonalGroup") -and ($_.Description -ne "SharepointList Folder") -and ($_.isOnDedicatedCapacity -ne "true") }  | Select-Object id

$ToBeDisabled=@()
$guid = $Personal_WS |ForEach-Object {$_.Id}  
$ToBeDisabled = @($guid) + $ToBeDisabled        

# If you have more than 500, you can use to batch it about 500 each time and loop thru the list
$size = 500
$bins = [Math]::Ceiling($ToBeDisabled.count / $size  )

for ($s = 0; $s -le $bins; $s++) {
    $skip = $size * $s 
    $ToBeDisabled_Batch = $ToBeDisabled | Select-Object -First $size -Skip $skip 
    $workspaceIds = @($ToBeDisabled_Batch.id )

    $body = @{
        capacityMigrationAssignments = @(@{
                #targetCapacityObjectId = $targetCapacity.Id;
                targetCapacityObjectId = "YOUR-ASKU-CAPACITY-OBJECT-ID";
                workspacesToAssign     = $workspaceIds
                            
            })
    }
                                
  
    $bodyStr = ConvertTo-Json $body -Depth 3       
                
    Try { 
        Invoke-PowerBIRestMethod -Url 'admin/capacities/AssignWorkspaces' -Method Post -body $bodyStr 
        write-host "$(Get-TimeStamp)    $($ToBeDisabled_Batch.count) Workspaces assigned to capacity (DISABLED): '$($targetCapacity.DisplayName)' " -ForegroundColor Green 
    }
    Catch {
        write-host "$(Get-TimeStamp)    Failed to disable or assign to Embedded A-SKU     " -ForegroundColor Red 
    } 
}
        
write-host "$(Get-TimeStamp) Disabled all $($ToBeDisabled.count) new Personal Workspaces !!" -ForegroundColor Green  

Hope this helps others!

You absolute legend!

 

I'd still rather this was a toggle in the tenant settings as it's going to be a lot of legwork to implement this, but I owe you a beer if I'm now able to stop our 40k users from uploading any old junk into personal workspaces.

v-angzheng-msft
Community Support
Community Support

Hi, @Anonymous 

 

As far as I know there is no such setting, disabling re-share permissions for reports, using row-level security for roles, and publishing an app to specific users might be workarounds.

 

refer:

Introduction to Workspace in Power BI, Assign Roles and Permission

Row-level security (RLS) with Power BI

Publish an app in Power BI

 

 

Best Regards,
Community Support Team _ Zeon Zheng


If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Greg_Deckler
Super User
Super User

@Anonymous It is deemed a "feature", self-service business intelligence. 😛



Follow on LinkedIn
@ me in replies or I'll lose your thread!!!
Instead of a Kudo, please vote for this idea
Become an expert!: Enterprise DNA
External Tools: MSHGQM
YouTube Channel!: Microsoft Hates Greg
Latest book!:
Power BI Cookbook Third Edition (Color)

DAX is easy, CALCULATE makes DAX hard...
Anonymous
Not applicable

@Greg_Deckler I'm onboard with self service BI, but this "feature" facilitates the unsolicited sharing of ungoverned reports to report consumers, who are presented with more than one version of the truth and potentially manipulated/falsified data. I don't see how it's a good idea to keep shared content in a personal workspace, especially if that user is on holiday or leaves the company. Shared content should reside in a dedicated shared workspace. This feature allows a backdoor to circumnavigate good data governance.

Greg_Deckler
Super User
Super User

@Anonymous To the best of my knowledge that setting does not exist.



Follow on LinkedIn
@ me in replies or I'll lose your thread!!!
Instead of a Kudo, please vote for this idea
Become an expert!: Enterprise DNA
External Tools: MSHGQM
YouTube Channel!: Microsoft Hates Greg
Latest book!:
Power BI Cookbook Third Edition (Color)

DAX is easy, CALCULATE makes DAX hard...

to the date this feteaure exist ?

I got excited when I found this post, looking for this exact setting for the same compliance reasons.  Personal workspaces are such a danger when users misuse (even by accident) the conveneinence and ease-of-use.  Microsoft makes it so easy for users it can be a nightmare for administrators.

Anonymous
Not applicable

How does everyone manage an environment where more than half of you do not have control over & can't restrict the damage that half can cause?


@Anonymous wrote:

How does everyone manage an environment where more than half of you do not have control over & can't restrict the damage that half can cause?


 

It never ceases to amaze me how shortsighted Microsoft can be on some things.  It's like they never have heard of the healthcare or government sectors.

 

The inability to STOP users from sharing data they shouldn't be, on top of the mess that personal workspaces are, have caused our organization to look for Power BI alternatives.  The cons just keep piling up.

Helpful resources

Announcements
November Carousel

Fabric Community Update - November 2024

Find out what's new and trending in the Fabric Community.

Live Sessions with Fabric DB

Be one of the first to start using Fabric Databases

Starting December 3, join live sessions with database experts and the Fabric product team to learn just how easy it is to get started.

Las Vegas 2025

Join us at the Microsoft Fabric Community Conference

March 31 - April 2, 2025, in Las Vegas, Nevada. Use code MSCUST for a $150 discount! Early Bird pricing ends December 9th.

Nov PBI Update Carousel

Power BI Monthly Update - November 2024

Check out the November 2024 Power BI update to learn about new features.