Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
7 months ago
Solved

How to Use a Single Workspace per Environment While Maintaining Report-Level Access in Power BI?

I currently have multiple workspaces in UAT and corresponding ones in Production, and this number may increase in the future. I want to simplify the structure by having one workspace per environment ...
Need Help
  • rohit1991's avatar
    rohit1991
    7 months ago

    Hii Anonymous 

     

    Power BI does not support report-level security inside a single workspace.To maintain one workspace per environment while preserving report-level access, the recommended approach is to publish multiple Power BI Apps from the same workspace, each exposing only the relevant reports to specific user groups.Workspace folders are for organization only and cannot be used for access control.

sarahlns's avatar
sarahlns
Frequent Visitor
7 months ago

Hello, 

Power BI does not support report-level security inside a workspace. Access control is workspace-level, so you cannot natively give different users access to different “folders” (reports) within the same workspace.

What is supported and recommended

✅ 1. One workspace per environment is OK

Having:

  • 1 workspace for UAT

  • 1 workspace for Production

is a common and valid pattern.

However, folders in a workspace are only for organization, not security.

❌ 2. Report-level access inside a workspace → NOT supported

  • You cannot restrict access to specific reports within a workspace

  • All workspace members (Viewer, Contributor, Member, Admin) see all reports

Recommended approaches to meet your goal

🔹 Option 1 – Single workspace + multiple Apps (BEST PRACTICE)

This is the officially recommended solution.

  • Keep one workspace per environment

  • Create multiple Power BI Apps from the same workspace

  • Each App:

    • Exposes only selected reports

    • Has its own audience (security group)

  • Users only see the App(s) they’re allowed to access

✅ No data duplication
✅ Clean governance
✅ Scales well
❌ Requires multiple Apps (but this is the intended design)

🔹 Option 2 – Workspace per audience (classic model)

  • One workspace = one security boundary

  • Fewer Apps

  • More workspaces to manage

Still valid, but less scalable long-term.

🔹 Option 3 – RLS (limited scope)

  • RLS only secures data, not reports

  • Users can still see the report itself

  • Not suitable for report-level visibility control