Forum Discussion
Security - share only certain Rows AND certain Tabs with users
This problem...
Copied the report to a new workspace, removed the unwanted tabs, filtered data down (just via the interface, no row level security) to what was wanted. Publish app, give access to external users: Problem: Error message about them needing permissions to the underling datasets.is caused by the target users not having "Read" permission to the source dataset. Once they've been provided this permission (in the dataset- "manage permissions" menu) - they will be able to see the app that you just created. Savvy users may figure out how to 'undo' the filters you set with the interface - but if you hide the slicer from view using the selection pane - you can maybe avoid having to setup RLS.
RLS is setup in the Power BI Desktop file - and if done correctly - you won't have the 'filter the data down' in the report canvas - because your security rules and roles will do that for you. This will require a bit more work on your part to set up the file - but should have the desired effect.
Either way - you'll still need to add the report viewers to a dataset permission role - in order for them to stop getting that error.
"Error message about them needing permissions to the underling datasets."
This problem...
Copied the report to a new workspace, removed the unwanted tabs, filtered data down (just via the interface, no row level security) to what was wanted. Publish app, give access to external users:
Problem: Error message about them needing permissions to the underling datasets.
is caused by the target users not having "Read" permission to the source dataset. Once they've been provided this permission (in the dataset- "manage permissions" menu) - they will be able to see the app that you just created. Savvy users may figure out how to 'undo' the filters you set with the interface - but if you hide the slicer from view using the selection pane - you can maybe avoid having to setup RLS.
RLS is setup in the Power BI Desktop file - and if done correctly - you won't have the 'filter the data down' in the report canvas - because your security rules and roles will do that for you. This will require a bit more work on your part to set up the file - but should have the desired effect.
Either way - you'll still need to add the report viewers to a dataset permission role - in order for them to stop getting that error.
"Error message about them needing permissions to the underling datasets."
Viewer means they have access to the workspace - as a viewer - which is basically 'read-only'.
"Read" means that don't have access to the workspace (so they won't see the workspace if they look for it)- but they will be able to access reports/apps built off of that dataset.
They are essentially the 'same' permission - except that Viewers are able to see the workspace in their Power BI account and 'see' any reports you have in there. You can switch Viewers to Read by removing them from the workspace access - and adding them to the Dataset permission.
swise001
I added the group with Read Access to the underling Dataset. They're still getting the error that they don't have access to the underlying dataset.
Do I *have* to click this option?Just to recap, right now I have:
- Dataset A in Workspace A
- ExternalUsers Group has read permission to Dataset A
- Dataset A has row level security - with Externalusers given access to a subset of the rows
- Report A, which uses Dataset A, copied over to Workspace B. Unwanted tabs removed
- App B published from Workspace B, and access given to External Users
You don't need to give users "build" access. That only pertains if they intend to 'build' their own reports using the same dataset.
At it relates to accessing the App (and its data) - it sounds like you've done everything correctly.
1. Users have access to the dataset
2. Users have access to the app
3. Users are included in a RLS role at the dataset (otherwise it would tell them it's restricted)
This all lines up pretty well.
The dataset connection to the App should be automatic and immediate - but you could always double-check by updating the app (or unpublish and republish it).