Shared dataset permissions

[CrazyHorse66]

Hi, thanks in advance for your help

We are rolling out self-service data access to a few 'power users' but struggling to configure the correct settings which enable the level of access we need.

Please advise the ideal set up to enable users to connect to the Power BI Dataset from specific individual reports only via PBI Desktop - essentially this is to enable SMEs to work with their specific data for analysis, which is the underlying data behind published reports.

Note we have an AD group set up for which we have enabled one setting in Admin Portal - Users can work with Datasets in Excel using a live connection - do we need to add this AD group to other settings as well?

Scenarios:

We have a BI REPORT HUB workspace which is where we have all our published reports.

Test 1:
User with no access to BI REPORT HUB workspace
Add Read, Build permission per report
They can see the reports to which they have been added
They cannot see the dataset in PBI Service
They cannot see the dataset from PBI Desktop

Test 2:

User with Viewer permission BI REPORT HUB workspace
Add Build permission per report - so Viewer,Build
They can see the report to which they have been added
They cannot see the dataset in PBI Service
They cannot see the dataset from PBI Desktop

Test 3:

User with Contributor permission BI REPORT HUB workspace
Add Build permission per report
They can see all reports - which is not as required
They can see the datasets in PBI Service
They can see the datasets from PBI Desktop
But Contributor gives too many high level options to interact with the data, and access to ALL reports/datasets so this does not work for us

[v-zhangti · Accepted solution]

Hi, @CrazyHorse66 

Here are some suggestions:

• 1. Create a new workspace specifically for the SMEs who need access to the underlying data. This will allow you to control access to the workspace and the datasets within it separately from the BI REPORT HUB workspace.
• 2. Add the AD group you mentioned to the workspace with the appropriate permissions. You may want to consider using the "Member" role for these users, which allows them to view and edit content within the workspace but does not give them full administrative privileges.
• 3. Within the workspace, create a separate dataset for each SME. This will allow them to work with their specific data for analysis without seeing other datasets they do not need access to.
• 4. When publishing reports, make sure to use the appropriate dataset for each report. This will ensure that the SMEs can only access the data they need for their specific reports.
• 5. In the Admin Portal, you may want to consider enabling the "Export Data" setting for the AD group. This will allow them to export data from the datasets they have access to, but not from other datasets in the workspace.

Dataset permissions - Power BI | Microsoft Learn

Build permission for shared datasets - Power BI | Microsoft Learn

Best Regards,

Community Support Team _Charlotte

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.