Power BI Apps - Option for "Allow Userse to Share the App and the apps underlying datasets..."?

[rodneyc8063_1]

Im doing some training on PBI currently and am on a module discussing Power BI Apps

I roughly get the idea that Apps are advantegoues in having an end user enviroment (Apps) and a seperate development enviroment (Workspace). I also understand its easier to share an app with a bundle of items vs sharing individual items one at a time from a workspace.

I noticed though that when creating an app there is a tab for "Permissions"

Now with these permissions theres 3 options

1) Allow all users to connect to the apps underlying datasets using the Build permission

Ok, so it sounds like this would allow an end user pretty much full access to everything in the app, so they can build their own reports using the dataset. Makes sense

2) Allow users to make a copy of the reports in this app

Ok, so this will allow someone to make a copy of a report I assume from the App and put it into lets say their own workspace. Then they can edit the report, add their own visuals etc. Makes sense so far.

3) Allow users to share the app and the apps underlying datasets using the share permission

This option is not so clear to me what exactly it does.

Once an app is created, a user can either be given a URL for the app to go and download. Or they can also search for it in the "Apps source" within PBI Service.

So why would there be an option to allow users to share the app? And why would this option also allow users to share the app AND the underlying datasets?

Im just confused what this option does exactly?

Any insight would be much appreciated!

[collinq · Accepted solution]

Hi @rodneyc8063_1 ,

This link will probably help answer a lot of those questions:

https://docs.microsoft.com/en-us/power-bi/collaborate-share/service-create-distribute-apps

In my mind, allowing users to connect to the underlying dataset with Build may defeat the purpose.  This allows the user to create their own reports and so you kind of have not "restricted" anything.  Yes, allowing users to make copies lets them put their own version somewhere else.

Allowing users to share the app and the underlying dataset is probably the "most dangerous" in my mind.  You might as well give them the desktop file.  This permission lets them share with anybody they want (based on their permissions and the permissions of the person being shared with).  Checking this is letting them give the app to anybody, particularly people that you don't want to get it.    AND, you are giving them the ability to share the dataset with other folks.

Yes, a person can get the App from the "get app" or from the link option.  The option to allow users to share the app is there in case you want to give away the farm.  Normally, to me, you use the app to share the report "as-is" and with some knowledge of who can get to it.  If you create an app and check that the person can then re-share it AND the dataset, you are giving them full rights to do as they please.  The option is there for the rare case that it is needed but I have never used it on an app.  In fact, I have never shared any of these on an app.  I use the app to specify individual or groups that I want to have access and that is all.  If I want somebody to do more (like make copies or use the dataset) I share that in the workspace and/or the report and/or the dataset directly.

FYI - I also check the "Install this app automatically" so that it is there next time open the service.

I would appreciate Kudos if my response was helpful. I would also appreciate it if you would Mark this As a Solution if it solved the problem. Thanks!

[rodneyc8063_1]

Hi @collinq !

Thank you for the very awesome and detailed reply!

While I was reading your reply I had a lot of "ohhhhhhh" <lightbulb on><clarity found> moments 🙂

I also found that web page and was reading through it, which helped me understand what the first two options were about (build and copy reports).

It was just that third option that made me go HUH?

So just to clarify - If I create an app and specifically only add user A access to the app - But I happen to check off "allow user to share the app and dataset...."

This would then allow user A to share the app AND data set with user B, their dad, their wife etc - Did I get this right?

Another question as well regarding the other two options (build and copy) - Lets say I allow "Roger" access to the app - and check off these two boxes for allow build/copy. This would allow Roger access to build reports using this dataset, or copy the reports from the app into any of his workspaces.

Roger loves this dataset, and then decides to mash up his own reports in his own "Roger Workspace". Once Roger is happy with his own reports built from the dataset from the app I shared - Lets say he wants to share it out to his buddies.

Im guessing since Roger built these reports on top of the dataset that I shared to him via my app - His buddies would NOT be able to view any of the data - Since I only shared my app/reports/dataset specifically to him ONLY.

So he would essentially need to come back to me, to ask me to add his buddies to the dataset so he can share out his reports and allow them to view the data from my dataset

Am I understanding that correctly?

[v-diye-msft]

Hi @rodneyc8063_1 

You are correct. and @collinq has explained very detailed ,"Allow users to share the app and the apps underlying datasets using the share permission", that is similar with a "Reshare" option and let the direct user of this app to share the underlying content to others. and the underlying dataset permission was mostly reflected in the "export data into csv/xlsx".

[rodneyc8063_1]

Hi @collinq 

Im still a tiny bit fuzzy about that jerk Roger

Lets say I created an app - and I share the link to Roger and I also only check the first two checkboxes. So I checked off

1-Allow all users to connect to the apps underlying dataset using the build permission

2-Allow users to make a copy of the reports in this app

Lets say Roger proceeds to make copies of the report in his "Roger workspace" - Then he throws on a few more visuals and another report tab. 

If I understand correctly, my dataset becomes a "Shared" dataset within "Roger workspace". So few questions here

-Lets say I modify my original dataset, change a few columns etc. Will these changes be reflected in Rogers reports in his "Roger workspace"? Im guessing yes? And therefore Rogers reports may also break potentially?

-Lets say Roger shares out his reports, that were built on my dataset out to Bob. This is where I get fuzzy - So will Bob be able to view the data from Rogers reports despite the dataset being from me?

I was thinking since my dataset is the "parent" and Rogers reports are built on my dataset - Any subsequent people Roger wants to share out to, Roger would need to come back to me to ask me to allow his friends read access on my dataset. 

Or does Roger have his own set of permission's on his "shared dataset" within his workspace?

I think I got a handle on what happens if person A shares to person B - Im just fuzzy on what happens when person B then moves on to share with person C.

I can find documentation from Microsoft regarding sharing/building from person A to B, but if person B wants to then share to C I cant seem to find any documentation on what happens?

[rodneyc8063_1]

Ok so this is interesting

I was bothering my co worker to try this out with me and this is what I found

My co worker had created a dataset in his workspace. He gave me "Read" and "Build" access on the dataset (no reshare).

I was able to go to "Get Data" and grab his dataset - And then built a quick report.

When I try to now share out my report that I built using a "shared dataset" I get the following error

This is with READ and BUILD access - So I am able to create content, BUT not able to share with anyone.

Also checking the dataset in my workspace I see that it is indeed a "Shared" dataset (via the icon on the left) - And when I try to click on the 3 dots (...) I only see the following options

So I dont see anywhere that I can manage permissions on this dataset (totally makes sense)

I then asked my co worker to give me READ, BUILD and RESHARE access on the dataset and I am now able to share my report with another colleague.

When I shared to my colleague I gave the following permissions

This gave my third colleague the ability to "Get Dataset" and she also showed up under the "Manage Permissions" of the original dataset with READ and BUILD (no reshare). 

I guess my concern was if user A shares with user B, then user B shares with user C - How can we "govern" the original dataset.

But it seems like if someone was given RESHARE and BUILD then they can pass it on to someone else. With simply BUILD, someone can build more reports but cant share any further. So overall its all technically still centrally being managed at the original dataset level. 

Very interesting!

[collinq]

Hey @rodneyc8063_1 ,

That was a great test and explanation - thanks for sharing those results!  That is some great knowledge about that type of scenario.

I would appreciate Kudos if my response was helpful. I would also appreciate it if you would Mark this As a Solution if it solved the problem. Thanks!

[collinq]

Hi @rodneyc8063_1 ,

You are correct - the wife, kids, dogs, cats and anybody else (with appropriate licensing of course) would be able to get to the dataset and app if the third check box is selected.

You are partially correct about that scoundrel Roger.  If Roger has full access and creates his own copies and uses the dataset then he has actually created his own report/workspace/dashboard/app that he can share.  Technically speaking he has to share HIS reports/app/etc and not re-share yours.  But, he could then share HIS report based on YOUR dataset with anybody else because he has created his own dataset (his copy of your dataset).  

You are correct that Roger can NOT share your dataset or APP or reports if he hasn't been given permissions to do so.

So, from the perspective of shareing YOUR app - he would have to ask you to do it if you don't give him share permissions.

Once again, that is why I never check those boxes for the APP.  I consider the APP to be the "this is what you are getting and you can click in it and use it as I intended it" share.  I consider the Dashboard/Report/Workspace/Dataset sharing to be various levels of "here is what I have created, based on the sharing I have done you can go do 'x'"     'x' being determined by exactly what share-ing and permissions you give them (from viewer to owner to personalized visuals...etc.etc.)

I would appreciate Kudos if my response was helpful. I would also appreciate it if you would Mark this As a Solution if it solved the problem. Thanks!