Power BI App with large audience initially prompting users to request access but then working fine

[DanDensley]

We have a Power BI App with an audience of ~10,000 users defined by a single AAD group. The App is in a premium workspace and the users will have either a Power BI Pro licence or a Free one already assigned. 

Since publishing the App to the service end users are not getting a consistent and clean experience when using the link. Some go straight through to the App, some get prompted to request permission but then on requesting they get a blank screen and if they try the link again it all works fine. NB: All end users should have access granted via the AAD group they are a member of, so no additional access permissions / requests should be needed.

I considered this may be related to how soon after publishing the App people are accessing it, but the problems persist even though it was published several days ago now. Any ideas?

[vivien57]

Hello everyone,

We still have the same problem. Is this a problem handled by the Microsoft teams? Because it seems that this is still considered as undesired behaviour.

If someone from the Microsoft team could give us some feedback, that would be great.

Thanks in advance,

Vivien

[DanDensley]

Hi Vivien,

We had some investigations from MS support and no complete solution was found. Of note:

1) It was variable as to how many people were impacted - sometimes it was ~50% other times much better.

2) If the Semantic Model is in the same workspace as the Reports for the App then it works better. I'd be interested to know if this is your set-up. We implement separation of concerns to keep Semantic Models in a "data" workspace separate from the reports and App.

3) We found that when someone experienced the issue simply refreshing the page seemed to resolve it immediately and for all future access.

My takeaway is that there is a mismatch between the service making a request to check if a person has appropriate rights to access the App and how long it waits for that response. So if a response is not received quickly enough it assumes the user doesn't have the correct access rights. On second attempt the response is back and access is allowed.

[vivien57]

Thank you very much for your feedback.

We currently have both scenarios, depending on the maturity of the owner's service. Sometimes the semantic model is in the same workspace as the report, sometimes in a different workspace. We haven't noticed that either scenario works better or worse.

In fact, with us too, after a refresh (following an error message due to an access problem) it works fine.

But it's not professional... we want to avoid having to put in the communications "It's normal if you have an error on the first display, refresh the page again and it will work"...

Do you know whether Microsoft has documented this as a bug they're working on ?

Thank in advance,

Vivien

[DanDensley]

They had trouble reproducing it, and given that was in a Reports + SM in the same workspace scenario that was what I had a suspicion about separation of concerns being a factor. If you are experiencing it in both situations then that is excluded. Have you got an open support call with MS? I can provide a reference to ours if that will help the investigations around yours. It really needs so low level technical analysis from MS side though. Someone with in depth knowledge about the permissions checks and processes.

[vivien57]

Hello @DanDensley ,

No, we have not opened a ticket with Microsoft.

However, I am very interested in the progress of your case.

Thank in advance,

Vivien

[Anonymous]

Hi @DanDensley ,

Based on your description, after your Power BI application is published in the service, users are experiencing an inconsistent and unclear experience when using the link. Some users are able to access the application directly, while others are presented with a blank screen after requesting permissions, but if they try the link again, everything works fine.

I think it might be a caching, privilege synchronization may be delayed even if the user belongs to an AAD group. Even if the application has been published for several days, some statuses may still be in process. You can check the release status of your application to make sure everything is in order.

For these questions I think first of all you are correct in customizing the access request behavior. Tracking user access patterns and logging issues. If the issue persists, it is recommended that you contact the Power BI support team. 

Best Regards

Yilong Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[DanDensley]

@Anonymous thank you for your reply. You mention:

---

You can check the release status of your application to make sure everything is in order.

How and where can I check this?

[DanDensley]

An update to the above as I've had more people test. Most get prompted to request access on first clicking the link, but if they close the tab without requesting it, wait a minute and then try the link again it all works fine.

Thinking a workaround is to customize the access request behavior and change the message to "If you are seeing this message close the browser tab and try again in a minute" but that's not a great first impression of the service for people.