Shared Datasets and underlying permissions

[Anonymous]

Hey gang - I have a question around using shared datasets and the proper way to grant permission to the underlying dataset. If a report in a separate workspace is using a shared dataset, what is the proper way to grant permission to that underlying dataset? Currently, if the user doesn't have access to the underlying dataset, they receive a permissions error and are not able to view the data in the report. I don't want the user to be able to access or read this dataset in anyway apart from simply being able to view the data in the report. The only way I saw to get this working is to go into the underlying dataset in the separate workspace and grant the user Read access. Is that really the best practice right now? 

[Streamline]

Hi @Anonymous ,

I have exactly the same issue. Do you already have a better solution then giving read access to the underlaying dataset in the other workspace to individual users?

[Anonymous]

I have not found anything better yet. It appears this is the best imperfect solution until Microsoft smoothens this out a bit. 

[rodneyc8063_1]

Just curious not sure if anyone has tried this yet but if "Build Access" was granted via the App to a user - This would mean the user can build out their own reports via this "shared dataset".

So lets say user A has the dataset and shared it out with build access to user B. Lets say user B then shares it out to user C

Does user A need to grant "read permissions" to user C in order to see the underlying dataset?

Or does user B grant access to user C - Therefore user A has no clue beyond user B where the dataset is being spread out to?

[mmace1]

Huh, me too. 

Trying to share with external users. 

Workspace 1 has the Dataset

Workspace 2 has a trimmed down copy of the report

Workspace 2 has an app, a group (of which these external users are a part), was given app access

Yet it keeps compalining about them not having access to the underlying dataset

[GilbertQ]

Hi there

The permissions that a user needs to build reports off a shared dataset is the build permission. You can enable this permission from either when you share the App with the user.

Or when you go into the dataset settings and then click on permissions and give them the access to build.

Here are more details in my blog post: https://www.fourmoo.com/2019/10/08/power-bi-bulk-changing-permissions-read-reshare-build-on-datasets...

[Anonymous]

Thanks, Gilbert. My main question though is how to share out the proper permissions when I don't want users to have Build access. I want them to simply be able to see the report. I don't want them to be able to be able to view or access the underlying dataset at all (besides obviously being able to see the data from it surfaced in the report). 

[GilbertQ]

Hi there

In order to do that you can share the reports via an App from an App Workspace.

That will allow them to have the permissions to view the data in the associated reports that have been shared in the App.

[Anonymous]

Thanks, Gilbert. I am sharing out the report via an App, but if Build permissions aren't granted, the user receives an error that they do not have access to the underlying dataset (which is in another workspace). 

I'm assuming the only way to grant them access without giving them the ability to build out reports with the dataset is to go into the workspace with the shared dataset, click on the Datasets tab > <DatasetName> ellipssis > manage permissions and grant Read access? 

[GilbertQ]

Hi there

As far as I know that should work.

When you go to the dataset permissions do the users not have "Read" permissions?

[Anonymous]

No, not automatically. Very strange! Thanks for the help and discussion! 

[GilbertQ]

No worries, something seems a bit off.

I have used shared datasets via an App and the users have always been able to view the reports.

There is no Row Level Security applied on the datasets?

[Anonymous]

Nope, no RLS. I even spun up a couple test workspaces and verified.

[GilbertQ]

That is unusual

I have even done this in the past with external users and they always could see the reports when loaded.

Could you send a screenshot of what the error is?

[Anonymous]

Absolutely. See below. I did see something in another forum about Microsoft having these permissions granted automatically at one point, but then switching it back to manual. I have not had any formal confirmation on that. 

[GilbertQ]

Yeah I am not sure either.

I do know if you share via the app, depending on what permissions were set when creating the app is how those users will be granted access.