Managing access to multiple reports for multiple projects in one workspace

[AhmedMorsy]

I have multiple project's reports to be published in one workspace, each project has certain users to access their reports. knowing that I have to give a consumer access to all project’s users to the workspace in order to allow them see the reports. I want to avoid they access the other project's reports not related to them.

Please share with me your thoughts on a way to control the access to only relevant reports.

[v-yalanwu-msft]

Hi, @AhmedMorsy ;

Page-level security and Visual-level security is not yet supported in Power BI.  we need workarounds to implement it.

https://radacad.com/page-level-security-workaround-in-power-bi

Page level security with RLS 

https://www.youtube.com/watch?v=an7n2kSTBk0

Best Regards,
Community Support Team _ Yalan Wu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[edhans]

Understand though that all workarounds are insecure. Nothing will prevent the user from seeing a page they are not supposed to see if they have access to the report and get the URL of the page if it is shared via email, teams or however, whether inadvertently or intentionally. 

Have any of these helped @AhmedMorsy ? If so, could you mark them by accepting as a solution. Note that there may not be the actualy solution you want due to product limitations at this time, so "there isn't a good solution for your particular scenario" is a good answer, just not the one you want.😁

[AhmedMorsy]

To merge 13 reports in one report is a quite challenging here and will make it very heavy to update the data. can I use the RLS only to give access to specific project report's?

[edhans]

No. RLS is at the record level - "ROW Level Security"

If you already have 13 reports, put them in different workspaces, and add users to the apps for those workspaces. The new workspace experience in Power BI - Power BI | Microsoft Docs

[edhans]

The best way is Row Level Security - RLS. As each user logs in, the report filters itself to only show what the Power BI dev allows for that user/user group. You have to write one report.

You can publish a "golden dataset" in one workspace, then create Live Connected reports to it in other workspaces that you restrict permissions to by user/user group. Downside is if you need to make a change to the report, you have to make the same change to all copies (adding a new visual for example)

You cannot restrict reports in a single workspace to a set of users. Everyone with access to the workspace/app can see all reports in the workspace/app.

You may google on ways to hide pages based on user. Do not rely on these tricks. They are clever, but not secure. Though a user may not be able to navigate to a page within the report, if Report User A has visibilty to page 2, and copies that URL to an email or chat and asks Report User B about it, even though User B shouldn't see it, that URL will work for them because they have access to the report.