Forum Discussion
Helper IIGive another user a Power BI Service report for customization?
Hi Akhil,
Thanks for following up. More than a week ago, we set it up for the user to be able to customize our existing reports. So far, I have not heard anything from the user. Cannot say whether no news is good news, or he has not tried it. Usually I take the former. I think we can consider this is closed. If we need further assistance, will reach out to the community again.
Thanks a lot for those who had helped!Warmest regards,
Dimani
Super UserHi Dimani
In your scenario, since the Power BI report is using DirectQuery to connect to a SQL Server via an on-premises data gateway with your credentials, another user cannot simply reuse that connection without proper access. When you send them a copy of the .pbix file, Power BI Desktop will prompt them to authenticate the data source using their own credentials—they must have access to both the SQL Server database and the gateway in order to refresh or query the data. You cannot share your credentials directly, and the gateway must be configured to allow their access through a defined data source user mapping in the Power BI Service.
If the other user only needs a subset of the data and shouldn't have full access to the SQL Server, a better approach is to publish the semantic model (dataset) yourself, apply row-level security (RLS) roles in Power BI Desktop, and configure those roles in the Power BI Service by assigning the user to appropriate roles. Then, instead of sharing the full .pbix file, you can give the user Build permission on the semantic model so they can connect to it from a blank report using “Get data > Power BI datasets,” and customize only the visuals without needing direct access to the database or gateway. This way, you keep control of the source data, ensure data access is restricted, and reduce risk, especially since the report uses DirectQuery where every user action potentially hits the underlying database.
Helper IIHi Poojara_D12 and Akash_Varuna,
Hope both of you had a good weekend! Thanks to both of your replies!
Poojara_D12 , thanks for your detail reply with highlight of the important points!
- Open the semantic model in Power BI Desktop
- Create a role in Power BI Desktop
- Publish the semantic model to Power BI Service
- Assign the user the role in Power BI Service
- Grant the user BUILT permission in Power BI Service
There is no need to give the user permission in the connection and gateway.
Follow-up questions:
1. Does the approach above work with any storage models in Power BI Desktop?
After posting my initial questions, I found that there are two more files in which the user is interested.
One has some tables using "Direct" storage mode and the rest of the tables using "Import" mode.
The other one has all of its tables using "Import" mode.
In both files, I noticed that the "Manage roles" option is available in Power BI Desktop, a sign that your approach would work for any storage mode?
2. Do I need to create scheduled refreshes for the semantic models that have any tables using "import" storge mode?
Since I will not grant the user permission in using the connection and the data gateway, to keep the data up to date for the user, I will have to create refresh schedules?
3. Can the user publish his reports in any workspace?
The user works in a different group, can he publish his reports in another workspace (not his personal workspace) where he can create an Power BI app to share his customized reports with his teammates?
Or he can only publish his reports in our workspace because the semantic models are in our workspace?
If the latter, I wonder if it is possible to have more than one Power BI app in the same workspace. From my initial search, it appears it is not possible.
4. Would it be better to update the semantic model files with a role, rather than updating the files with a role and do a save as to new files? Or it depends?
It seems from the maintenance point of view, it would be less work if we simply add a role to the existing semantic model files instead of saving them to a different set of files. Wonder if there are reasons we may want to create another set of semantic model files for the user.
Thank you!