Forum Discussion
How to Differentiate Between Directly Shared Access and Workspace Level Access in Power BI
Hi, Neeraj_I
When you open the corresponding workspace, you can see what reports, semantic models, dashboards, etc. exist in that workspace:
For reports in a workspace, you can manage permission to see which users have been granted direct access:
Then you can see what roles are assigned to users in the workspace in the workspace's manage access:
In workspace, different roles have different permissions:
Roles in workspaces in Power BI - Power BI | Microsoft Learn
I hope my suggestions give you good ideas, if you have any more questions, please clarify in a follow-up reply.
Best Regards,
Fen Ling,
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Thank you so much Anonymous for taking the time to explain with screenshot.
As a tenant admin, I'm responsible for managing access to over 10,000+ workspaces and 30,000+ reports across our organization. While I understand that roles assigned to a workspace automatically grant certain permissions, I'm facing a challenge in identifying users who have only been granted access to specific reports without having roles assigned at the workspace level.
Currently, it's possible to check report permissions and workspace roles manually by navigating to the "Manage Permission" section of each report and workspace. However, this manual process is unsustainable at scale given the size of our tenant.
What I need:
I'm looking for a way to extract this data at a granular level—essentially a raw dataset that includes:
- Users assigned roles at the workspace level.
- Users who have been given permissions only to specific reports without any workspace roles.
This data will allow me to build a comprehensive report to answer key questions such as, "Who has access to limited reports but no roles at the workspace level?"
Sample scenario:
Example:
- Let's say Workspace A contains 10 reports.
- User X is assigned the "Contributor" role in Workspace A. This means User X has permissions to edit and manage all 10 reports in the workspace (Read Reshare).
However, imagine User Y is not assigned any role in Workspace A, but a specific report, Report 5, is shared with them. In this case:
- User Y will only have permissions to view or interact with Report 5 (depending on the sharing settings).
- User Y won't be able to access any other reports in Workspace A, and they won’t appear in the workspace’s list of users with assigned roles.
This distinction is important for tracking permissions across your environment, as users can have granular report-level access without appearing in the workspace’s role list.
Why API access is needed:
Manually consolidating this data by going through each report and workspace would be extremely time-consuming. I need a solution that leverages APIs to retrieve this information for all workspaces and reports across our tenant, so that I can efficiently build and automate reports to monitor user access and security compliance.
Has anyone tackled a similar issue, or could you point me to the relevant API endpoints or scripts to help achieve this? Any suggestions or insights would be greatly appreciated!