doesnt user need permissions on data source even if given viewer on a workspace?

[db042190]

Hi, i've always been under the impression that even if i give a user viewer on a workspace, he'd need permisssions on the actual data source (eg login there ,  ssas viewer role member etc) as well.   For instance in one set of cube based reports, we give users read on the cube (usually by adding them to an ad group with that role in ssas) before giving them viewer on one or more ws's.  i could swear i've seen security errors on the cube itself after a user is given viewer on a ws with a report that uses that cube but not having also given them ssas viewer (read) first.  But today i'm looking at a user who doesnt seem to have any explicit permission on a relational db and yet he can run a report in a ws (he has viewer in the ws) where we feature a report that uses that relational db.  Can the community clarify?

[Anonymous]

Hi @db042190 ,

I want to validate the valuable input provided by @Idrissshatila . Their initial thoughts helped guide my approach. However, I've noticed that I need more detail to fully understand the issue.

In Power BI, when a user is assigned the Viewer role in a workspace, they are granted permission to view and interact with content (reports, dashboards, etc.) that is shared within that workspace. This includes content built on data models or databases, and does not necessarily require direct access to the underlying data source.

However, use the Viewer role to enforce row-level security (RLS) for users who view content in the workspace. You can also enforce RLS without granting access to the workspace, publish the application and distribute it to these users, or use shares to distribute the content. The situation you are experiencing may therefore be related to RLS, for more details refer to the document: Roles in workspaces in Power BI - Power BI | Microsoft Learn.

If your Current Period does not refer to this, please clarify in a follow-up reply.

Best Regards,

Clara Gong

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Idrissshatila]

Hello @db042190 ,

a user with a viewer role on a workspace that is viewing a report, he can view the report even if he doesn't have access to the datasource.

[db042190]

thx, any idea how i saw once on a ws viewer an error after he went to run a report in that ws saying he didnt have permissions to read that cube?  i know it doesnt 100% prove my point but here is some evidence i could scrape up from the experience.  This guy was in the ws trying to run the top report.  We later gave him viewer in ssas too and then all was ok (coincidence?) ...our ssas db is also called semanticmodel....