Give ALL USERS Dataset read access (but not build or reshare), then limit access to App. Thoughts?

[mmace1]

We have datasets that support reports/apps in other Workspaces.

This means one can't just share the report/app, one also has to share access to the underlying Dataset(s) with the users

In our environment, the PowerBI team can't create nor manage Security Groups. So every request to create/modify a Security Group is a potential pain point.

My thought: A Security Group for ALL USERS Exists. So grant Dataset access to ALL USERS (not build or reshare, just read access).

i.e. - So say we don't want Joe to see anything - fine. Joe has Read access to all Datasets, but since he has access to 0 Reports/Apps, and can't build - he can't actually see anything.

Thoughts / Drawbacks / Insane? 

[GilbertQ · Accepted solution]

Hi @mmace1 

Yeah that should work

I always suggesting testing it to make sure it works as expected.

[GilbertQ]

Hi @mmace1 

Yeah that should be ok, I thought you were doing it via the dataset permissions.

If they got read access they can only read it via a report and NOT build any reports.

[mmace1]

@GilbertQ 

I mean, I *am* doing it via the dataset permissions. I'd just (hypothetically) be giving all users Read only access to the dataset, not Build. 

And since they wouldn't be given access to any Workspaces, Reports, nor Apps - they couldn't actually see anything, is the idea. 

[GilbertQ]

Hi there

If a user has got read access, when they open Power BI desktop and connect to the Power BI Datasets they then would see all the datasets that they have got access to and can build reports.

Whilst it might be a pain with security groups I would suggest keeping this inline to ensure that only the people who should see the data can see the data?

[mmace1]

@GilbertQ 

Are you sure they'd be able to build anything?  I thought that was the distinction of checking (or not checking) the build checkbox: