Forum Discussion
Update object level security (OLS) roles
There's a very detailed table available here: Roles in the new workspaces in Power BI - Power BI | Microsoft Docs
If a workspace member was a viewer but had build permissions on the dataset they could build a report on the dataset in power bi desktop or in the service and save to their "My Workspace".
But yes your last sentence is correct.
So we have a workspace called DW-Models. Myself and one colleague who create the models are member of that workspace.
Everyone else is granted access to the models via:
and given either Read or Read and Build permissions.
Read allows someone to view a report built on top of the dataset in any other workspace.
Build allows someone to build a report on top of the dataset which they could publish somewhere else.
Neither allows them to edit the model in any way.
Thnx bcdobbs
And how is that then related to their role in their own Workspace (WS-B or WS-C) , for instance Contributor or Viewer? Has it use to give the role Viewer build permission?
But nevertheless, what you say is: store the datasets in a separate workspace, let IT handle that and no end-user can mess up /update role information ??
There's a very detailed table available here: Roles in the new workspaces in Power BI - Power BI | Microsoft Docs
If a workspace member was a viewer but had build permissions on the dataset they could build a report on the dataset in power bi desktop or in the service and save to their "My Workspace".
But yes your last sentence is correct.Thnx bcdobbs for all your answers. I am gonna read the link. Great !!
One last question bcdobbs :
OLS and RLS is only for the Viewer role, because the other roles have edit permission.
But what if in 'Manage permissions' of a shared dataset (that resides in a separate workspace), I give a Viewer or Contributor of workspace X Build permission. Does for both the Viewer and Contributor RLS / OLS not count anymore for that dataset?? Does it only count for persons with Read permission?Think of a workspace like a server. (Under the covers it is basically an analysis service instance). Viewer/Contributer etc control what you can do on that server. If you have sufficient privaledge you complete control of stuff on that server.
What you are doing in workspace X is giving people control over reports they publish and any datasets they create on that workspace. If however those reports query data from another workspace the users of workspace X can't change anything about the remote dataset.