How to manage access control for a portal report that contains links to other reports

[Fern_21]

Hi all!

I've a report that functions as a unified access portal, containing links to other reports. I need to ensure that each Azure AD group can access only the report relevant to them, while not being able to view the others. How can I manage this?

Currently, I have a single workspace where everyone can see everything, since there's only one group assigned as viewer. I was considering creating an app with different audiences (groups), so that each group can see only their relevant report.

How can I combine this with the need for a portal report — a single access point for viewing the dashboards, without removing the existing viewer group from the workspace

Thanks

[v-ssriganesh]

Hi @Fern_21,

Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to @Tutu_in_YYC & @Cookistador for sharing valuable insights.

Could you please confirm if your query has been resolved by the provided solution? If so, please mark it as the solution. This will help other community members solve similar problems faster.

Thank you.

[Tutu_in_YYC]

Hi Fern,
1. Do you want users to only see the link of reports, that they have access to? or
2. Do you want the users to see all available links, but when they click the link, they should only be able view the report that they have access to?

If you are are managing access through security groups, you shouldnt worried that user that are not the the group are accessing report they dont have access to.

However, permission to view a report happens in many layers:
1. Workspace access (through role in the workspace)
2. App access
3. Direct report access

If security groups for those reports are also used in different workspaces, they might get access to more reports that you think.

[Fern_21]

Hi @Tutu_in_YYC !

The user should be able to see all the buttons (which contain links to the reports), but if they click on one they don't have access to, they should not be able to open it. Additionally, if they click on a report they do have access to (which is inside an app), they should only see that specific report and not the others available in the app.

Thanks

[Tutu_in_YYC]

To achieve that, you have to first remove the group from the workspace. This is the one that give permission to see everything.

Then create different groups for different reports or audience. Only assign the groups on the audience level within the app.

And lastly, create a report (this will be your portal) that is also in the app, and assign to all audiences. This way everybody will have access to the "Portal", and from the portal they can click to go to their reports (that are in the same app).

Let me know if that helps

[R1k91]

Audiences hide the content but don't block launching via a button if you have it (I suppose) therefore if you have a button for each report you'll basically giving access to all people.

moreover viewer on the workspace give acess to all the reports therefore you should remove it if you want to segregate.

I don't think the type of setup you want to accomplish is feasible with Power BI only features, probably you need to manage this using a custom portal that embeds Power BI.

Power BI embedded analytics overview - Power BI | Microsoft Learn

The "portal report" must be substituted by a web page that could be based on a custom database where you can define which pages a user can see and block the rendering of a report if he's not supposed to see it.

[Cookistador]

Hello @Fern_21 

If you want to block the access to the report to the users, you have to remove this viewer access (by default, with the viewer rights, a person can see all elements in a workspace)

The best approach would be to remove this workspace access and then creating an app with the right audience