Granting access to a report doesn't give access to a dataset if it's in another workspace?

[twintrbl]

I need a sanity check from other Power BI users to see if this is just us or if this is how it works for everyone else too...

Everything I've read about report rights is that if you grant a user read rights to a report, it should also grant read rights to the dataset. However...  We keep most of our datasets in one workspace (where only admins have rights at the workspace level) and put reports/content in separate workspaces geared toward the different departments. 

Scenario:

Workspace HomeBase - rights at the workspace level only grant Admins rights to read or build to the reports and datasets (unless other people are added individually).

• Dataset A
• Dataset B

Workspace Human_Resources - Read rights granted at the workspace level to the HumanResources Dept only

• Report 123 based on Dataset A - report rights inherited from Workspace only
• Report 456 based on Dataset A - rights inherited from Workspace, but also granted Read to John Doe. John Doe can now see this report in his "Shared with Me" list, but doesn't see the Human_Resources workspace.

Workspace Sales - rights given to the Sales Department and their management

• Report 789 based on Dataset A - rights inherited from Workspace only
• Report 999 based on Dataset B - rights inherited from Workspace, but also granted Read to Sally Doe

When you add the rights for Reports 123 and 456 to the Group "Human Resources", that should grant rights to the Dataset A for the Group "Human Resources" as well. Same for granting rights to Report 456 just to John Doe - it should grant John Doe rights to Dataset A.

Same scenario for the Workspace Sales, which has rights granted to the Group "Sales". That same Group should have rights to both Dataset A and Dataset B, since they have rights to the reports 789 and 999. Also, Dataset B should have read rights to Sally Doe.

If you go back to the HomeBase workspace and look at the rights, it *should* show the following:

Dataset A - 
"Human Resources" - Read

"Sales" - Read

John Doe - Read

Dataset B - 

"Sales" - Read

Sally Doe - Read

However, in reality, only some of those rights are filtering through. I haven't been able to do any organized testing on it, but sometimes granting rights to a report will grant rights to the dataset, but sometimes it doesn't. And I can't figure out in which cases it does or doesn't. And this quirk doesn't seem to be documented anywhere, so I don't know what we're doing wrong. All I know is that a report is visible to our executives based on the "Executive" group having rights to the entire workspace (and this group appears in the Manage Permissions list for the report as Workspace Viewer), but when they click on the report, then they get an error that says they don't have permission to view the data. We go look at Permissions for the Dataset, and the "Executive" group isn't there.

We're going through everything with a fine tooth comb and over complicating things to make absolutely certain that management can see their reports, but I'm a little spooked for any future reports/datasets we create.

Maybe granting rights at the Workspace level only grants rights to the reports and datasets in that workspace, but workspace-level rights don't cascade to the underlying datasets??

I can't find any documentation on this or even any acknowledgement that this could happen. 

Can anyone shed any light?

[GilbertQ · Accepted solution]

Hi @twintrbl 

Hopefully what I explain below will make it easier to understand and get it working for you.

• If the report and dataset existing in the SAME App Workspace, you can grant report access and the users will see the reports and data.
• If the dataset exists in ANOTHER App workspace, you have to go into the dataset "Manage Permissions" and grant the users "Read" permissions on the dataset.
  • Once you have granted the "read" permissions on the dataset, you can then grant the share/view permissions on your report.