Unable to see/connect to PowerBI Dataset published on viewer access

[zuheirashraf17]

Hi All,

We would like to set up a reusable Power BI Dataset Model and based on the documentation HERE, its totally can be done. The problem here, during our testing, users can't even see the dataset if they don't have a workspace access of [Contributor] or higher. 

This defeat the purpose as we don't want them to make any changes on the workspace but only to reuse the dataset and made a report out of it on their own. Also this dataset has a RLS applied, by giving them contributor access, RLS no longer apply to them.

More info:

- I've checked on the 'Manage Permission' of the dataset, Read/Viewer and Build access has been granted.

- To eliminate that this is due to RLS issue, user has been added to the Roles on the Dataset Security setting.

- The model reside on the workspace which is part of the Premium capacity [P1]

- The workspace is already on the new experience workspace.

I don't have the access to the Tenant setting, do let me know if there is some setting on the tenant level which disabling this.

I have access to the capacity settings, I can't see any related setting that could cause the issues.

Please advise.

[collinq]

Hi @zuheirashraf17 ,

I believe the system is working "as intended" in this case - if you have a large dataset you want others to use, then you need to give them at least contributor, which, in turn allows them to see and use data you don't want them to use in this case.

I am wondering if the way to adhere to your requirements would be to create a set of reports with the restrictions that you want and share those to the users AND give them the ability to create/modify reports based on those reports - that way they can edit and create without having to engage with you.  THis at least keeps them limited to the data in the reports that you provide to them.

[zuheirashraf17]

First of all, thank you for taking your time to reply on top of this. As per your suggestion, it wouldn't be practical in our case as the report will totally based on the RLS applied and it's dynamic per user basis. For example, User A will have a combination of Country 'AZ' and Product Group 'AB', and User B will have a combination of Country 'CS' and Product Group  'ZA'. The combination can easily take up to more than 100.

So what we're looking for is totally within what is documented.

- Reusable live dataset with a model like a relationship and measures already pre-configured (Like AAS)

- Users can use the data within the specified role. (RLS applied)

- We don't really mind if the users need to be added to the workspace as long as we can keep the RLS applied on them.

This is the 2 main requirement, and both of them were mentioned in the documentation. If the system were designed otherwise, why would bother to mention them in the first place. 

[collinq]

HI @zuheirashraf17 ,

I am wondering if the first line of that screenshot is the item that is not allowing what you want.  The line I refer to is "Only users with Build permission for a dataset can connect to a published dataset using the Power BI service live connection."    And, based on this article, How content is organized in workspaces - Power BI | Microsoft Docs that means contributor level access.  Which, as you state, may give more permission to that user than you want and might allow them to circumvent RLS.

This may be worthy of creating a ticket and seeing if Microsoft can assist you with threading this needle and explaining the differences in what the documentation indicates.

owever, in that same article, I noticed that 

[zuheirashraf17 · Accepted solution]

Hi @collinq 

Thank you for your time. 

Fortunately, I've found out some leads about this issue yesterday. I reached out to our organization Tenant admin and actually there is a tenant-level setting that controls this feature, there is an article published which I missed out;

Dataset across workspace 

Since this setting affecting the whole tenant, we are going to discuss and see if this going to have a huge impact on our organization. (Securities and capacities)

--

So coming back to your reference, build permission can be given to the user at the dataset settings. And this can be done even without having the user be added into the workspaces, this is related to the following article;

Dataset Across Workspaces 

[FJV]

I'm facing the same problem. New Premium Workspace with a Dataset. Users with Viewer access to the workspace and Viewer+Build access to the dataset still can't see the dataset in the datahub or in Power BI Desktop-Power BI Datasets connector. Even with the mentioned tenant setting (Use Dataset across Workspaces) activated.

I don't want to make them Contributor of this workspace, although this would solve the problem.

Datasets became vissible in Datasetthub and Power BI Desktop when, in addition to the Viewer+Build rights, I marked the dataset as Promoted and checked the Make Discoverable checkbox.

I expected this to work without these last settings. Anybody more info or ideas on this item?

[zuheirashraf17]

Hi FJV,

Yeah as for me, once the setting on the tenant level has been applied. User able to access the dataset through power bi desktop without issues.

Just wondering if the steps you provide access to the user is the same as mine;

here is what I did to grant the user access:

1. Dataset >  Manage Permission;
   
   
   
2. On the dataset access page > Add User
   
   
   
3. add user or ad group with reshare and build access.
   

Perhaps you can try this one out and see if its working?

[v-robertq-msft]

Hi, @zuheirashraf17 

According to my test before, the “Viewer” role in the workspace can make the RLS work on the users even if they are accessed with the dataset. I guess the “Viewer” role in the workspace can “forbid” the users from datasets within the workspace.

Therefore, I think you truly need to read the document about datasets across the workspace. Maybe you can create another workspace to give them access to the datasets you wanted them to use to create reports.

Introduction of using datasets across workspaces

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[zuheirashraf17]

Hi @v-robertq-msft 

Thanks for taking your time. 

We manage to solve this by granting access to a specific audience in the Tenant Settings. Only users within this group can Build a Report using the dataset across the workspace. The only concern for us is to assign security role (if RLS is applied) to the report viewer.

So yeah the 'report builder' doesn't need to have access to the workspace directly 'Viewer'/'Contributor'/''Member' is no longer a concern.

Regards

Zuheir