Impact & reversibility of disabling "Use semantic models across workspaces"

[nixonba2]

Hello,

After reading the documenation I still don't understand precisely what disabling "Use semantic models across workspaces" will do in my tenant, so I don't know how best to prepare. I know we want this disabled for information security reasons, but I want to ensure a smooth transition for the users. I considered briefly switching it off to run some tests then switch it back on, but I cannot establish if it is strongly reversible. My questions are:

1. In general, does this setting only prevent the creation of new cross-workspace content, or does it block access to (or delete) existing reports in shared workspaces that are connected to semantic models in other workspaces?
2. Does this setting apply to "My Workspace" workspaces in the same way as shared workspaces? That is, will it block access to (or delete) reports in users' "My Workspace" that are connected to semantic models in other workspaces?
3. Does this setting override share links that grant users access to content in workspaces of which they are not a member?
4. Is this setting strongly reversible or does turning it off remove content or permissions that would not be restored were it to be turned back on?

Thank you,

[nixonba2 · Accepted solution]

I created a new tenant to test this and get the answers to my questions:

1. In general, does this setting only prevent the creation of new cross-workspace content, or does it block access to (or delete) existing reports in shared workspaces that are connected to semantic models in other workspaces?
   1. It only prevents the creation of new cross-workspace content. Existing cross-workspace reports remain in the list, are viewable and maintain a live connection to the underlying semantic model. However, this setting prevents the editing of such reports.
2. Does this setting apply to "My Workspace" workspaces in the same way as shared workspaces? That is, will it block access to (or delete) reports in users' "My Workspace" that are connected to semantic models in other workspaces?
   1. Yes, this setting applies to "My Workspace" workspaces in the same way.
3. Does this setting override share links that grant users access to content in workspaces of which they are not a member?
   1. No, except insofar as if a user has Build permissions (either via link or "direct access") to a semantic model in a workspace of which they are not a member, they can no longer use that permission to build reports, because they cannot save those reports anywhere. Even from Power BI desktop they cannot connect to a semantic model they have direct access to if they do not have at least Contributor role on the workspace.
4. Is this setting strongly reversible or does turning it off remove content or permissions that would not be restored were it to be turned back on?
   1. It is strongly reversible.

[nixonba2]

Thank you for suggesting an alternate approach, @nandic. I read that document and spent much time considering that approach but unfortunately it does not work for my organization because we have some fields and tables that only certain user groups are allowed to see, but OLS and RLS only apply to the Viewer workspace role, and we want users to have build permissions in their respective workspaces. From what I understand, Power BI offers no way to permit a user to build reports against a dataset without permitting him access to every table and field in that dataset. I agree it is inconvenient to have to maintain several variations of a dataset! I find the best way is to do work on the most complete version, then have a documented procedure for deleting fields/tables to spawn the more restrictive variants.

@Anonymous can you please undo your marking of this topic as solved? I am still hoping for answers to my 4 questions.

[nandic]

@nixonba2 i find this link much more useful: https://learn.microsoft.com/en-us/power-bi/connect-data/service-datasets-across-workspaces

In general, if you want to have 1 central dataset and want to allow report creators from multiple teams to create reports based on that central datasets and publish them to different workspaces, you need to enable this option.

Otherwise, you would need to have the same dataset in multiple workspaces and each of them needs to be refreshed.

I haven't seen any issues with this option, i find sharing dataset across workspaces very useful for centralized reporting. 
Refresh is taking only once and if there are any changes, you make them only on central dataset.
Otherwise, you would need to fix same things on multiple datasets.

Cheers,
Nemanja Andic