Reports and Dataset/Semantic Model Security

[arock-well]

I'm creating a report that the whole company will be able to access via a Workspace App. The report is connected to a dataset/semantic model that contains some data that is restricted to certain users. Within the report, they do not see these restricted data fields displayed in visuals

However, I'm concerned that even though they can't see the restricted data in the report, they would be able access it if they connect to the dataset directly.

I'm looking for recommendations and help understanding the best route:

• Is there a way to allow access to only the report, but nobody is allowed direct access to the dataset?
• Or, is this solved by updating the dataset to remove the restricted fields from the model?
• Or, is there something else I should do, like row-level security?

[aj1973]

Hi @arock-well 

Using Power BI Apps environment is meant exactly for your needs. Good practices are :

• Create 3 Workspaces 1- WS_Dev & Test, 2- WS_Dataset Prod only ,3- WS_Report Prod only(for Thin reports)
• From WS_Report Prod only create the App 
• In the App add your users or Securtiy groups to different audiences to view reports
• Go back to WS_Dataset Prod only and click on the 3 dots next to the Dataset to Manage permissions
• New window will open where you can give access to your audience as Viewers

Do not add users to Workspaces Prod unless it is really necessary.

[arock-well]

@aj1973 This is basically the bottom line question:  

I don't want people in the company to be able access the backend dataset at all. I just want them to only be able to view the report. Is this possible?

[aj1973]

Indeed, the steps i recommended do not give access to users to datasets. Users will only view reports.

Users need to have Viewer permission on the datasets in order for them to see data on reports and that doesn't give access to the datasets nor they can see them

[arock-well]

@aj1973 What's the difference between Viewer permission on a dataset vs. Read permission? When I go to the dataset the only options I see are these and I don't see a "Viewer" option: 

Just to confirm: "Read" permission to a dataset doesn't allow users to connect to a dataset and create new reports? And, just as important, see the underlying fields and associated data in that dataset?

[aj1973 · Accepted solution]

Read is same as Viewer.

Yes with Read permission, user can't see the dataset.

[arock-well]

@aj1973 You've been very helpful and what you described appears to be working.

However, I have another related question. When I go to remove Read access to a dataset I get this warning first: 

It's asking if I also want to remove access to two reports that use that dataset. This is confusing as I would think by the very fact I'm removing access to the underlying dataset that those reports would automatically not be available.

If I do not check those two reports, does the user still the ability to somehow view those reports, even if they don't have Read permission to the underlying dataset any longer?

[aj1973]

Yes the user will still see reports but with no data in it coming from that specific dataset.

Remember a report can be developped from a Composite Model, like a combination of 2 datasets in the Azure Analisys Service.

[arock-well]

@aj1973 Ok, the situation of having more than one dataset in a report composite model would make sense to ask about removing access to the whole report.

Once again, thanks for your help!

[aj1973]

Carefull, a Report can not have more than one dataset. The dataset can contain more than one dataset and it is called a composite model.

[arock-well]

@aj1973 Thanks for the quick reply. Currently my workspaces are set up pretty much like you outlined. In "WS_Dataset Prod", this is where the production datasets reside.

Then I have a separate "WS_Report Prod" workspace . This is where the reports reside that point back to the datasets on "WS_Dataset Prod" and where users access reports via the Workspace App I created there.

So I understand, are you saying I don't need to give permissions to the dataset in the "WS_Report Prod" workspace? All I have to do is set permissions to the Workspace App on "WS_Report Prod"?

Just to clarify, I don't want people in the company to be able access the backend dataset at all. I just want them to only be able to view the report.