Publish & Solution Governance

[icassiem]

Hi,

We have an issue in my organization where users are not deplpyinhg from the central governed location on sharepoint where the prod version of solutions are stored, in fact the latest version is either stored on PC and even deployed to personal workspace. The users can add users permissions in service but i have a few cowboys doing there own thing and i have received a request to provide some governance to how these data champs publish or save their excel sources which also an addtional folder within depot parent folder?

1. Is there a way, where i can force publish from a network "sharepoint" location only

2. Publish to access allowed workspace and no personal workspaces as there's links are forwarded

3. A way where only i manage the access to the dept folder in an analhytics workspace "i guess this si more sharepoint"

4. Enfore monitoring/logs of reports or workspace usage or links share

5. Checks that file sources are indeed located in the dept parent source folder

i dont want to be the blocker of deplying & manually checking source locations etc. for them, then just going to encourage their personl workspace links share

Please help, what successfull modern simple governance does people apply that i could replicate?

Regards

[v-venuppu · Accepted solution]

Hi @icassiem ,

you can’t fully block local publishing, but you can control it with a few steps:

Store all approved PBIX files in one governed SharePoint/OneDrive folder (read-only for users).In Power BI Admin Portal, turn off “Download PBIX” and “Publish to Web.”Limit workspace Admin roles to governance owners; others get Contributor access only.Use Power Automate or Admin APIs to flag reports not published from the approved folder.This keeps publishing controlled without needing to check every file manually.

Thank you.

[icassiem]

Thank you both @v-venuppu & @xifeng_L 

for guiding me, i am going to try a few of the recommended advise

regards

[v-venuppu]

Hi @icassiem ,

Thank you for reaching out to Microsoft Fabric Community.

Thank you @xifeng_L for the prompt response.

Adding to the helpful points already provided by @xifeng_L for questions 2,4, and 5, here’s how you can handle 1 and 3 in a practical way:

Regarding question 1: You can't technically force publishing only from SharePoint, but you can enforce it by storing all approved PBIX files in a governed SharePoint/OneDrive folder and disabling PBIX download in Tenant Settings. This ensures users must work from the central source instead of personal copies.

Regarding question 3: To ensure only you manage access, assign users the Contributor role (so they can publish/update) but keep the Admin role restricted to governance owners only. Also disable “Allow contributors to update the app” in workspace settings to maintain controlled sharing rights.

[icassiem]

Thank You @v-venuppu 

How ould i do this? "enforce it by storing all approved PBIX files in a governed SharePoint/OneDrive folder" because they will publish from PC, unless an admin is esrablished to check

i feel for this to work, there must be a dom champion the issue the champions are the cowboys, sources  )files) & solutions located on PC etc

[xifeng_L]

My workspace cannot be disabled, but you can use Content Sharing report(At Admin Monitoring workspace) to find out which workspaces have how many reports and how many people have shared them with.

And, you also can use PowerAutomate or the alert function to notify you when a user is detected publishing a report to my workspace.

[icassiem]

@xifeng_L  thank you, i think the Content Sharing report is for Fabirc License

Alert, still requires me to action.

I was really hoping there's governance framework i could implement to secure this type of cowboy behaviours

[xifeng_L]

Hi @icassiem 

I cannot fully answer your question, but I can answer 2, 4, and 5.

Regarding question 2, it is possible to have "My Workspace" reside on shared capacity, so that when sharing reports with other users, they also need to have PRO Licenses to access them. I believe not many people have PRO licenses, so in order to ensure that ordinary users can also access reports normally, they can only publish reports in designated premium capacity workspaces.

Regarding question 4, if you are a PowerBI administrator, you can view the sharing status of various reports or workspaces in the Content Sharing report of the Admin Monitoring workspace.

Regarding question 5, it may be possible to implement it in conjunction with PowerAutomate and PowerBI's REST API.

Did I answer your question? If yes, pls mark my post as a solution and appreciate your Kudos !

Thank you~

[icassiem]

@xifeng_L Thank You

All users has Pro as part of MS License. I think the CFO wants to ensure that users are not blindly developing with solution from PC and publish to workspace and continue sharing. It does not sound like its possible unless, i can disbale personla workspaces? and i publish once they copied solutions to the sharepoint central location? This method fels the strongest governance but very old school and dependent on me

Also with no ingest tools, nor Fabirc lcenses i wanted to have a Audit dashboard of all reports but difficult with the default reports 30 days etc and having to dev all within powerbi rest API i guess

Any ideas, kindly advise?