Issue with Sharing Linked Dataflows in Power BI

[Hazzzy]

I have a Power BI workspace containing multiple dataflows that source data from Excel files stored in a SharePoint folder. I need to share specific dataflows with other users but want to avoid adding them to the existing workspace, as this would grant them access to all dataflows in that workspace.

To address this, I created a separate workspace and imported one of my dataflows as a linked dataflow. I then granted access to the users in the new workspace. However, the users cannot see the linked dataflow when trying to import it into Excel or Power BI Desktop. They can see other dataflows I created directly in the new workspace but not the linked ones.

What could be causing this issue, and what are the possible solutions?

[v-csrikanth]

Hi @Hazzzy 

We haven't heard from you since last response and just wanted to check whether the solution provided has worked for you. If yes, please accept as solution to help others benefit. If not, feel free to reach out.
Feel free to reach out if you need any further assistance.

We look forward to your update!

Thank you,

Cheri Srikanth.

[v-csrikanth · Accepted solution]

Hi @Hazzzy 
Welcome to the Microsoft Fabric Community.
The issue occurs because linked dataflows in Power BI depend on the permissions of the original dataflow. If users in the new workspace don't have access to the original workspace, they cannot access the linked dataflow.

Grant Viewer Access to the Original Workspace:

• Provide the users with Viewer permissions in the original workspace containing the source dataflow. This will enable them to access the linked dataflow through the new workspace.

Create a Separate Dataflow:

• Instead of using a linked dataflow, create a new dataflow in the new workspace by importing data directly from the SharePoint folder or exporting and importing the original dataflow definition.

Use Shared Datasets:

• Publish a shared dataset from the original dataflow. Share the dataset in the new workspace without linking the dataflow. This ensures that users can access the processed data without requiring access to the original workspace.

Service Principal and Security Groups:

• Use a service principal with permissions to access the source dataflow and configure it in the linked dataflow. Ensure the service principal handles dataflow dependencies securely.

• Direct Data Export:

  • Export the data from the source dataflow to a new storage location (e.g., Azure Blob Storage, another SharePoint folder) and create a new dataflow in the new workspace to source data from there.

If the above information helps you, please give us a Kudos and marked the reply as a solution.
Thanks,
Cheri Srikanth

[Hazzzy]

Thank you, Cheri, for suggesting multiple workarounds. Using shared datasets is a good idea, and I'll proceed with that. I have a question: When a dataset or semantic model is imported into Excel, does it retain the row-level security configured in Power BI?

I'd also like to learn more about using service principals and security groups for this purpose. Could you recommend some efficient resources for learning about this topic without requiring a significant time investment?

Finally, regarding direct data export, is it possible to save an Excel file to SharePoint that automatically refreshes a query without manual intervention?

[v-csrikanth]

Hi @Hazzzy 
Sorry for the late reply.
1) If the dataset is imported (instead of being connected live), the RLS will not be applied because the data is static in Excel. For reference: https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security 
2) To efficiently learn about service principals and security groups, you can explore the following resources:
https://learn.microsoft.com/en-us/power-bi/developer/embedded/embed-service-principal?tabs=azure-por... 
https://learn.microsoft.com/en-us/entra/fundamentals/how-to-manage-groups 
3) You can achieve automatic refresh of Excel data stored in SharePoint using the below link.
https://support.microsoft.com/en-us/office/refreshing-data-in-a-workbook-in-sharepoint-server-895601... 

If the above information helps you, please give us a Kudos and marked the reply Accept as a Solution.

Thanks and Regards,
Cheri Srikanth

[lbendlin]

The users need access to the workspace that holds the actual dataflows.  If you are concerned about giving them access to the other content in that workspace then move that other content somewhere else.

[Hazzzy]

Thank you, Ibendlin. This approach could work, but it would require creating and maintaining user access for many workspaces. This adds a lot of extra work, which I would like to avoid. Is there a more efficient way to achieve this?

[lbendlin]

Consider Occam's Razor.  Dataflows are additional steps. If you can avoid them, don't use them at all.