The ultimate Fabric, Power BI, SQL, and AI community-led learning event. Save €200 with code FABCOMM.
Get registeredEnhance your career with this limited time 50% discount on Fabric and Power BI exams. Ends September 15. Request your voucher.
Hello,
I'm working on a solution for senior leaders in a protected department in my organization. It will probably take the form of an app for access from the service or from Teams. There will be 50-100 monthly users.
Power BI free is my organization's default license type, and I don't want the hastle of making sure all users (which will obviously be an ever changing group) are upgraded to Pro.
My organization is very large, and I would be surprised if we weren't paying for multiple premium capacities already.
My solution needs to be protected (in its workspace, which I will eventually create) so that access is restricted only to my whitelist.
However, my understanding is that the administrator(s) of whatever premium capacity I find can add themselves to my workspace and, then, have full access to all of the data therein. That isn't acceptable for my requirements. I'm expecting that the capacity admins will be in IT, whereas only the leaders in my department (not IT) should be able to access the data for the solution.
My department would not pay to set up its own premium capacity simply for my one solution.
Obviously, I wouldn't want a situation in which an admin could add himself to the workspace, download/copy content, and then remove himself from the workspace.
Is there a way that I can keep my workspace safe from the admins? If not, how would you handle the type of deployment I'm trying to accomplish?
All advice is greatly appreciated.
Solved! Go to Solution.
Nope, cant be done. RLS based on static list or say AD group is over ridden by Admins. Thats sort of the point of admins. Probably have a look at your orgaisations policies on data access. Because data is generally in the remit of IT they will have access to the most sensitive data like, HR, Legal or contract.
ooooo, I am not sure about that sorry.
I realized I should have also been asking this, @samdthompson.
Can capacity admins also give themselves access to a workspace, like the power bi service admins can?
Nope, cant be done. RLS based on static list or say AD group is over ridden by Admins. Thats sort of the point of admins. Probably have a look at your orgaisations policies on data access. Because data is generally in the remit of IT they will have access to the most sensitive data like, HR, Legal or contract.
Thanks for your reply, @samdthompson. Now, you have me curious.
Would I face the same/similar issue if I did not assign the workspace to a capacity and decided to make everyone have a pro account? My understanding is that my personal workspace is not accessible to anyone but me, but I'm asking about other workspaces not bound to a capacity (since I want to use an app for deployment).