Quarterly audit for user access to Workspaces, Apps, dashboards, and reports.

[caseycook]

I need to be able to audit who has access to workspaces, apps, reports, and dashboards on a quarterly basis.  Is there a way to pull this information either via powershell or within Power BI itself?  I can't use the azure audit logs since they only look at activity, not potential activity.  I couldn't find a Powershell Cmdlet that pulls members of a workspace, or app.  Please tell me this is feasable, I really don't feel like manually going through everything.

[GilbertQ · Accepted solution]

Hi there

There are Power BI Admin APIs which will allow you to get the information you require.

Here is an example of an API that gets all the users in an App Workspace.

Yes this could all be put into a PowerShell script and loop through all the App Workspaces

https://docs.microsoft.com/en-us/rest/api/power-bi/admin/groups_getgroupsasadmin#get_workspaces_with...)

[GilbertQ · Accepted solution]

Hi there

There are Power BI Admin APIs which will allow you to get the information you require.

Here is an example of an API that gets all the users in an App Workspace.

Yes this could all be put into a PowerShell script and loop through all the App Workspaces

https://docs.microsoft.com/en-us/rest/api/power-bi/admin/groups_getgroupsasadmin#get_workspaces_with...)

[caseycook]

---

@GilbertQ wrote:
Hi there

There are Power BI Admin APIs which will allow you to get the information you require.

Here is an example of an API that gets all the users in an App Workspace.

Yes this could all be put into a PowerShell script and loop through all the App Workspaces

https://docs.microsoft.com/en-us/rest/api/power-bi/admin/groups_getgroupsasadmin#get_workspaces_with...)

---

It appears that you can only expand the users in the new workspace experience.  Is there a way to get the users for the old workspaces?

https://docs.microsoft.com/en-us/rest/api/power-bi/admin/groups_getgroupsasadmin#get_workspaces_with...

[GilbertQ · Accepted solution]

Currently that is not possible.

And in the near future all App Workspaces will be migrated to the V2 App Workspaces, which then will allow you to view the members.

[caseycook]

---

@GilbertQ wrote:
Currently that is not possible.

And in the near future all App Workspaces will be migrated to the V2 App Workspaces, which then will allow you to view the members.

---

So, it seems I could use the method above to pull for new workspaces, and then Get-UnifiedGroup for the old workspaces?

[caseycook]

@GilbertQ 

When I run this command I get the users: Get-PowerBIWorkspace -Scope Organization

However when I try to Get-PowerBIWorkspace -Scope Organization -top 50 | ConvertTo-Json the users all show up "as Microsoft.PowerBI.Common.Api.Workspaces.WorkspaceUser"  Is there a way to just keep the users as a json?

[caseycook]

This seemed to do it

Get-PowerBIWorkspace -Scope Organization -top 5000 | ConvertTo-Json -Depth 3

---

---

[GilbertQ]

Awesome, thanks for letting us know.