Permissions keeps removing groups

[jdsg]

I have an application which is supposed to be distributed to two email groups.

I add the two groups, click Update App and it seemingly works.  When I go back to Update App a second time, one of the groups is removed.

It turns out this group is removed even if it is the only group that is in there.

Is there some way to figure out why this group is being removed?

[v-xicai]

Hi @jdsg ,

To create or update an app, you need a Power BI Pro license. For app consumers, there are two options.

• Option 1: All business users need Power BI Pro licenses to view your app.
• Option 2: If your app workspace resides in a Power BI Premium capacity, free users in your organization can view app content. Read What is Power BI Premium? for details.

On Permissions, decide who has access to the app, and what they can do with it.

• In classic workspaces: everyone in your organization, specific people, or Azure Active Directory (AAD) security groups.
• In the new experience workspaces: specific people, AAD security groups and distribution lists, and Office 365 Groups. All workspace users are automatically given access to the app for the workspace.
• You can allow app users to connect to the app's underlying datasets using the Build permission. These datasets will appear in dataset search experiences.
• You can allow app users to make a copy of reports in this app to their My workspace.

Note: If your app relies on datasets from other workspaces, it is your responsibility to ensure all app users have access to the underlying datasets.

You can learn more:https://docs.microsoft.com/en-us/power-bi/service-create-distribute-apps.

Best Regards,

Amy

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[jdsg]

Hi @v-xicai ,

We are indeed in Option 2 with this app workspace falling into the Power BI Premium capacity.

I am trying to add two groups to the Permissions using the "Specific individuals or group" radio button.  I type in the two groups (ENG_DEPT_ILOX_US and ACCOUNTING_ALL_US) and both are recognized.  I select them, click Update app and it tells me that it can take some time.

I leave the page, wait, and later go back to it.  When I go back, it has removed ENG_DEPT_ILOX_US for reasons unknown to me--that's what I am trying to figure out.

Does the email address box show only valid groups or is it possible this group does not meet the requirements?  Also, is there a way to check if I am in a classic workspace or the new one (I am betting classic).

I am just not sure if this is a PowerBI bug or something I am doing--regardless the PowerBI interface isn't helping me figure it out

Thanks

[v-xicai]

Hi @jdsg ,

Currently, there are some differences between the classic workspace and new workspace. For example the following UI page:

You can learn more about the differences between the classic workspace and new workspace: https://docs.microsoft.com/en-us/power-bi/service-new-workspaces#how-the-new-workspaces-are-differen....

Please check if the users and groups have access to this workspace.

Best Regards,

Amy

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[jdsg · Accepted solution]

It looks like what was happening was rather simple, but it was non-obvious.

The group I was trying to share with has Access to the entire workspace as the relatively new "Viewer" role where the application is published.  Because of this, you can't add the group directly to the application--it will automatically remove that group (without saying anything) because they already have access through the workspace (seems obvious, but was unclear in application).

Thank you for the help,

John

[rossnruthie]

Thanks for coming back and posting an update!  We were having the exact same issue however we were embedding the app in sharepoint and the group users were unable to see the report in sharepoint until we removed viewer from the workspace and added them on the app instead.