How to allow access to a Dataset to the Entire Organization?

[anselmojg]

How to allow the Entire Organization to access a ‘thin’ report published in a workspace App that is connected to a dataset hosted in a separate workspace?

(Note: all workspaces under Premium capacity)

We are struggling to understand how to handle this:

• The front facing App is configured to provide access to the Entire Organization allowing access to the App’s underlying datasets using the Build permission. The reports in this workspace App are “thin” reports.

• The underlying datasets are in a separate workspace. Each dataset can have its access granted to specific people and groups; for each the Build permission can also be added. But there seems to be no option to grant access to the dataset for the “Entire Organization” (again, if the sensitivity of the content deems that as appropriate)

We are finding that the users must be granted access to the dataset either individually or via a group that they belong to. The problem with that is that the “Entire organization” is made up of hundreds or thousands of users, with many new users being incorporated constantly while others get removed. Maintaining individual accesses or groups to keep all up to date is a daunting task.

So, is there any way to set up a dataset with Build permission for the Entire Organization? Again, this applies to datasets with no sensitive data that a large organization wants to consume.

[Jeg]

Hi, Thanks for bringing up this question and thank you so much for sharing the solutions! I have a follow up question. Assuming I give 'Read' permission to a Certified dataset for the entire organization. Will it impact the performance of the dataset or the reports using that certified dataset as data source?
Please note that the certified dataset imports data from SQL server database.
Thank you for your time and support!

[gmelhaff]

Ah....it depends!  Hows that for an answer?  Remember this is all just SSAS tabular in the backend.  But by default it's a shared tabular resource/server.  So there's lots of variables here.

Is your dataset direct query or import?   

• Direct query means it's Rolap - it's getting data from your rdbms backend and passing it through so you're backend database is getting hit the most to serve the needs.  
• If dataset is import then it's Molap - it's all in memory in your premium server so lots of people reading the data is less of an impact. 
• There there's also Holap (some import, some direct query).

Do you have premium site license? 

Is the workspace setup as premium?   If so, how well is your premium server handling the workload right now?   

It depends on what kind of backend server is getting used to serve up the data.  No premium site license (or workspace not setup for premium server use) then it's shared tabular data engine. 

So worse case scenario is - no premium site license (or overloaded dedicated server) and doing direct query against overloaded backend source(s).   Best case is import say nightly in off hours and dedicated server for tabular serving up in-memory data to your users.  And ideally your PBI region is same as your backend PBI server and backend servers.  Also ideally if you're using PBI gateway that is also co-located in same region (basically everything in same region so no region crossing needed).  

FYI:  As of today Microsoft can't yet move PBI to a different region than your default for your tenant.  We've now tried it I think 6 times unsucessfully.  They hope to have that fixed by end of this month.  We've been waiting 6 months so far to fix this.  

[Jeg]

Hi, Thank you so much for the detailed explanation.  It really helped me to implement most of the check boxes to not to overload the dataset. My dataset is import (MOLAP), its in premium capacity, workload is approx 30%, scheduled refresh if off hours and PBI region is local. 
Thanks again and really appreciate your quick response.

[gmelhaff]

I had the same problem.  @arvindsingh802 suggested contacting O365 admins which you could but you know how that can go trying to explain to an O365 admin what powerbi is and what you're trying to do 😞   If you have access to Azure portal just go into Azure Active Directory and look through the groups there.  I did that and found a group with all our employees in it similar to what we had with Windows AD.  If you don't have access then I'd suggest going to an Azure admin rather than O365 admin.  Just suggestion. 

[arvindsingh802 · Accepted solution]

Please get in touch with your O365 Admin team, usually they do have groups having all associates added and you do not have to worry about addition/deletion of associates.
use that group to provide access to entire organization, in that way each user will have build access as well.

If this post helps, then please consider Accept it as the solution, Appreciate your Kudos!