How to grant users access to reports built in Workspace A, downloaded and published to Workspace B

[ucherukuri]

Hello, we have a data engineering workspace (Workspace A) where we build out our medallion architecture and build reports. We download these reports and publish to various different workspaces based on the target audience (Finance has a Finance reports workspace). So we built the report and published to Workspace B. 

Users are added as Workspace viewers in workspace B and added in Workspace A semantic model direct access as Read/Reshare. 

This security setup does not work. Our users are unable to view the reports and we have reported 3 separate types of errors that occur, what is a better security setup to avoid errors?

[Anonymous]

Hi,@ucherukuri .

Has your problem been solved?
If you have found suitable solutions, please share them as it will help more users with similar problems.
Or you can mark the valid suggestions provided by other users as solutions.

I hope my suggestions give you good ideas, if you have any more questions, please clarify in a follow-up reply.
Best Regards,
Carson Jian,
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous]

Hi,Tutu_in_YYC .thanks for your concern about this issue.

Your answer is excellent!
And I would like to share some additional solutions below.
Hi,@ucherukuri .I am glad to help you.
You need to make sure that users have enough access rights to workspaceA, workspaceB, and data sources.
I recommend that you assign contributor permissions to the target users in workspaceA and workspaceB, test if assigning such roles solves the problem, and then gradually narrow down the scope of permissions in the worksapce.
Also for the data source, I've been discussing with other members of the team that users need to have read permissions on the data source side so that they can view reports, even if they can't edit them.
I don't seem to be able to view the screenshot of the error you shared earlier in the forum, if so could you share the screenshot in question which would help resolve the issue.
Of course, if your problem is solved, you can share your solution, which will help more people on the forum with similar problems.

I hope my suggestions give you good ideas, if you have any more questions, please clarify in a follow-up reply.

Best Regards,

Carson Jian,

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Tutu_in_YYC]

Can you provide the screenshot of the errors?

---

@ucherukuri wrote:

Users are added as Workspace viewers in workspace B and added in Workspace A semantic model direct access as Read/Reshare. 

Permission wise, the setup you have should work.

[ucherukuri]

Thank you - I've been thinking I'm doing something wrong. I also have some RLS policies in the semantic model, the 3rd error (didnt get screenshot) was complaining that RLS policies not applied. 

[Tutu_in_YYC]

see if this helps with the first error
https://community.fabric.microsoft.com/t5/Desktop/SELECT-Permission-denied-error-from-Power-BI-Deskt...

For RLS, you just need to assign the role to the viewer.

[ucherukuri]

I looked through the post and am confused, where did the user go to uncheck the automatically selected checkbox?

[Tutu_in_YYC]

yeah i cant seem to find that in my direct lake settings too. He probably did it in import mode

Try giving the user access to the lakehouse first.
https://community.fabric.microsoft.com/t5/Service/Fabric-and-Power-BI-report/td-p/3348722

[ucherukuri]

I have confirmed that the user has read/readdata access in the SQL endpoint lakehouse. Should I also give the permission further upstream in the Fabric lakehouse?

[Tutu_in_YYC]

I think it is still access issues. I would try to idenfity how far upstream i need to go to solve the access issue, note it, and revoke what is not necessary.

If that still doesnt work, then we might need to submit a ticket to Microsoft

[ucherukuri]

Thank you for the assist! Confirming for the thread that the user has confirmed access as far upstream as I can go (only read access) and the user is still experiencing error. 

[Tutu_in_YYC]

also, wait 5-10mins after every permission changes and make sure the viewer clear his/her browser cache. sometimes it takes a while and sometimes the browser just showing the cache

[ucherukuri]

(Removed Screenshot) - error = SELECT permission or external policy action was denied on the object X database DBNAME, schema SCHEMA The exception was raised by the IDbCommand interface

[Tutu_in_YYC]

The first error  tells me you might be using directlake/direct query mode, is that true?

The second is your visual is just trying to run calculation more than what you have for computing power. In this case, you might need to reduce the amount of data needs to be processed or get higher compute through premium capacity.

[ucherukuri]

Yes my tables in semantic model are Direct Lake