Power BI Report and Dashboards (Dataverse Source) Access by Non-Dataverse Licenced Users

[pp365]

Hi everyone,

I've spent quite a lot of time researching online and can't seem to find a straightforward answer to this, so hoping someone can help.

Scenario

I am designing a solution which is based in Dataverse. A small number of users ("Group A") will be licenced for Power Apps Premium, and will use a Model Driven App to directly interface with the data.

The remainder, larger number of users ("Group B"), need to access a Power BI Report or Dashboard which uses the Dataverse data as its source. The intention is that this report or dashboard would be accessible via a URL, or maybe embedded in a SharePoint site. It will not be within a Model Driven App, etc. Group B are licenced for Power BI Pro, but are not licenced for Power Apps Premium (or any other form of "Dataverse licence").

Questions:

1. Will users in Group B be able to access the Power BI report, or dashboard, which uses Dataverse as its data source?

2. Does it make any difference if the report/dashboard is hosted within a SharePoint site, or pinned in a Team? (Note - all users at the org have access to Teams and SharePoint).

Thank you very much for your help in advance.

[Anonymous]

Hi @pp365,

Thank you for reaching out to Microsoft Fabric Community Forum.

I trust that the super users have addressed the majority of your questions.
Adding to the below points Row-Level Security (RLS) can be implemented effectively in Import mode.

Costs of Using Dataflows or Azure SQL

• Dataflows: Included with Power BI Pro or Premium licenses. No extra licensing cost for creating and managing dataflows as long as you remain within Power BI's ecosystem.
• Azure SQL Database: This incurs additional costs based on Storage and query usage.

Regarding the refresh with import mode, it supports both manual and scheduled refreshes.

If this post helps, then please consider Accepting as solution to help the other members find it more quickly, don't forget to give a "Kudos" – I’d truly appreciate it!

Regards,
Vinay Pabbu

[christinepayton]

Users should be able to view Dataverse-source Power BI reports on import mode. If you're not sure, just run a test with a user. Import more uses the user account that runs the refresh to access the data, and once it's in the model there's not a distinction on where it came from. The only place you'll run into issues is direct query, since that uses the current user's access level. 

As far as where it's used, that's just the place it's displayed, so no. It still lives in the Power BI app, it's just shown in various different places depending on the technique you're using. Just make sure the users have access to the site or team as well as the report. 

[pp365]

Hi @christinepayton ,

Thanks very much for your help and presenting this alternative approach.

Using the method you've described, would it still respect  Row Level Security ? A key aspect of the requirement is that each user should only see their own data in the resulting report/dashboard. The user group is large and will be quite dynamic so I am aiming to avoid any manual addition/removal of users or creation of individual reports or dashboards etc. 

Just to double check there would be no additional licence requirements/costs with this approach.

Finally, with Import mode, how is the data refreshed from the source; is it on demand when a user chooses to access the relevant report/dashboard, or some other cadence?

Thank you very much for your help.

[christinepayton · Accepted solution]

Import mode is scheduled refresh, up to 8x per day on PBI pro license tier. I'm confused about where your row ownership is coming from if your group B doesn't have Power Apps premium licensing - is it coming from their Dataverse roles, or have you set up your own RLS on the Power BI side?

Direct query can use Dataverse role filtering, Import mode you would need to configure your own RLS rules using DAX. If you have some field in your dataset that you're using, like an owner email address, you can use RLS in import mode. The typical way people set this up is with USERPRINCIPALNAME() vs a field in the dataset, but there's other dynamic methods. 

Honestly, direct query might not trigger premium licensing either - I think it's just accessing it via the app where you hit the licensing wall, as long as your users all have access to the tables via security roles and access to the environment it might work that way too. I'm not 100% sure on that though. 

[pp365]

Hi @christinepayton ,

Thank you, that's extremley helpful.

@christinepayton wrote:

[...] I'm confused about where your row ownership is coming from if your group B doesn't have Power Apps premium licensing - is it coming from their Dataverse roles, or have you set up your own RLS on the Power BI side?

[...] Import mode you would need to configure your own RLS rules using DAX. If you have some field in your dataset that you're using, like an owner email address, you can use RLS in import mode. The typical way people set this up is with USERPRINCIPALNAME() vs a field in the dataset

This is spot on - we wouldn't be specifying the record ownership in Dataverse for Group B since they won't have the licencing for Dataverse (via Power Apps Premium), instead, the intention was to leverage RLS via DAX, in the way you've described (which I also noted was the methodology suggested on this resource which I found to be clear, well explained and documented/presented).

Thanks again for taking the time to help me out @rohit1991 , @Anonymous  and @christinepayton . I think this provides the necessary detail to at least run a Proof of Concept and hopefully it will match what I understand to be the logic explained on this thread. 

Many thanks!

[rohit1991]

Hi 

Just to sum up the licensing question around Power BI reports using Dataverse as a source:

If your report’s data source is Dataverse, then every user who wants to view that report must have the correct Dataverse (Power Apps Premium) license—this is true whether you share the report via Teams, SharePoint, or a direct link. Embedding the report doesn’t change the underlying licensing requirement, and Power BI Pro/Premium alone doesn’t bypass it.

If you have users who don’t have Dataverse licenses but need access, the recommended workaround is to export or sync the required Dataverse data to an intermediate location like Azure SQL, Power BI Dataflow, or Data Lake. Build your Power BI report off this new data source, and then you can share the report with any user who has a Power BI license—no need for Dataverse licensing for those viewers. You can still apply Row-Level Security in the Power BI model to control what users see.

I've checked this approach against Microsoft’s latest documentation and community advice, and as of now, there isn’t any supported way to get around Dataverse licensing for report viewers if you keep Dataverse as the direct source. Using an intermediate storage is the only supported and scalable way.

[pp365]

Thank you very much for your help, @rohit1991 . I am new to Dataflows / Azure SQL.

1. Apart from the Microsoft Learn article on this (hopefully I've identified the correct article), are there any resources you could recommend I take a look at to try and decipher what's needed?

2. Do you know if there are additional licences/costs that would be incurred with the use of Dataflows / Azure SQL to achieve the requirement?

3. Would Row Level Security still be achievable on the resulting report/dashboard when using Dataflows?

4. Finally, now that I know the originally presented scenario is not feasible, based on the requirement, is there any other solution or approach you would recommend?

Once again a huge thanks for your help and expertise, it's very much appreciated.