Forum Discussion
Reports and Dataset/Semantic Model Security
I'm creating a report that the whole company will be able to access via a Workspace App. The report is connected to a dataset/semantic model that contains some data that is restricted to certain users. Within the report, they do not see these restricted data fields displayed in visuals
However, I'm concerned that even though they can't see the restricted data in the report, they would be able access it if they connect to the dataset directly.
I'm looking for recommendations and help understanding the best route:
- Is there a way to allow access to only the report, but nobody is allowed direct access to the dataset?
- Or, is this solved by updating the dataset to remove the restricted fields from the model?
- Or, is there something else I should do, like row-level security?
Read is same as Viewer.
Yes with Read permission, user can't see the dataset.
10 Replies
Hi arock-well
Using Power BI Apps environment is meant exactly for your needs. Good practices are :
- Create 3 Workspaces 1- WS_Dev & Test, 2- WS_Dataset Prod only ,3- WS_Report Prod only(for Thin reports)
- From WS_Report Prod only create the App
- In the App add your users or Securtiy groups to different audiences to view reports
- Go back to WS_Dataset Prod only and click on the 3 dots next to the Dataset to Manage permissions
- New window will open where you can give access to your audience as Viewers
Do not add users to Workspaces Prod unless it is really necessary.
aj1973 Thanks for the quick reply. Currently my workspaces are set up pretty much like you outlined. In "WS_Dataset Prod", this is where the production datasets reside.
Then I have a separate "WS_Report Prod" workspace . This is where the reports reside that point back to the datasets on "WS_Dataset Prod" and where users access reports via the Workspace App I created there.
So I understand, are you saying I don't need to give permissions to the dataset in the "WS_Report Prod" workspace? All I have to do is set permissions to the Workspace App on "WS_Report Prod"?
Just to clarify, I don't want people in the company to be able access the backend dataset at all. I just want them to only be able to view the report.
aj1973 This is basically the bottom line question:
I don't want people in the company to be able access the backend dataset at all. I just want them to only be able to view the report. Is this possible?
Indeed, the steps i recommended do not give access to users to datasets. Users will only view reports.
Users need to have Viewer permission on the datasets in order for them to see data on reports and that doesn't give access to the datasets nor they can see them
