"App, Reshare" permissions keep coming back.

[ToddChitt]

I have an App Workspace (new style) and for the Dataset Permissions, I list several individual names. For each, I remove the "Reshare" permission. 

I then PUBLISH the App and on the Permissions tab, uncheck all the boxes. The same names are listed here as on the Dataset Permissions area.

After publishing, all the users listed under Dataset Permissions are back to having "App, Reshare".

How do I STOP the users from having "RESHARE" permissions? Why does it keep coming back.

[nach_pbi]

Hi @ToddChitt @StianHog @v-shex-msft @MiraNi @AndyWald -

When publishing an app, say I checkmark the Build permission (not the share) and add user1 to the audience, then user1 gets App(Build) permission on the dataset. This is as expected.

User1 can build their own reports by making a live connection to this dataset. This is also as expected.

User1 is able to share report with user2 who has absolutely no access on the dataset, or the dataset's workspace, and yet user2 is able to view the report. Is this expected?

It looks like the user1 is automatically getting share permission on the dataset. But when I look at the dataset permission, User1 has only got App(Build). So then why is User1 getting share permission on the datset?

I have raised a question here:

https://community.powerbi.com/t5/Issues/App-build-permission-allows-user-to-share-report-with-user-t...

https://community.powerbi.com/t5/Service/App-build-permission-allows-user-to-share-report-with-user-...

[Anonymous]

It's possible to do this through the API and some scripts. It's an unusual workflow I've not heard anyone request before and having permissions removed form so many files seems like it's going to cause a lot of issues and time to reshare those files when others need them.

I hope this helps!

Admin

Apps4rent | O365cloudexperts

[Anonymous]

@v-shex-msft 

Any update from the Power BI team about this bug?  This prevents me from using Power BI apps, as I cannot afford reshare permission being granted on sensitive datasets.

[MiraNi]

This must be fixed! A reshare user right should not be on as a default.

[ToddChitt]

@v-shex-msft 

Any word? Has Microsoft acknowledged the issue bug?

Being a security thing, this should have percolated to the top of the stack, yet NO WORD?

Sorry to say, I'm losing faith with Microsoft in their ability to deal with all the requests and issues. 

*heavy sigh*

[JCM]

Hello,

We are also experiencing the same issue in our organisation. It seems to be "by-design". I have created an idea in the Microsoft Power BI Ideas. Please use this link if you wish to vote.

[AndyWald]

Thank you for creating the Idea.  

This is really disappointing if it is "by design".  It causes real security risks since it appears that the reshare functionality makes RLS not work correctly, particularly with regards to exporting data.  

[v-shex-msft]

HI @ToddChitt ,

According to your steps, I can reproduce your scenario. I will report this to power bi team and update here if any ETA.
Regards,

Xiaoxin Sheng

[ToddChitt]

@v-shex-msftAny word on this? You created a BUG report on or about 9/11? That was 15 WEEKS ago. I still see the behavior. I still see this as a MAJOR SECURITY RISK as I CANNOT STOP OTHERS FROM SHARING SOMETHING. This should have gone to the top of the list.

Please advise.

[v-shex-msft]

Hi All,

Respond from PG: This is an expected result. Power bi app will re-assign permissions after you update your app.

Regards,

Xiaoxin Sheng

[Anonymous]

Hi @v-shex-msft Thanks for the update.

It makes sense that power bi reassigns permissions when an app is published, this has not been our concern.

Our concern is that when publishing, power bi grants reshare permissions on the dataset to everyone that just has access.  These are new permissions not specified by the publisher.  We are trying to understand why and how these new permissions keep getting added. 

[StianHog]

Hi, 

Did some testing that solved the problem/bug.

I created a new app workspace -> Published the same report -> Updated app with same users-> No change in user reshare access. 

Hope this can be a workaround for you as well. 

[ToddChitt]

@StianHog Please detail the steps taken for us, and confirm that after REMOVING the Reshare permission from users, and after re-publishing the app, that the Reshare permissions do NOT come back. 

If, as you claim, it works as WE (not Microsoft) expect and the Reshare permissions do NOT come back for a NEW App Workspace, but DO come back for an existing Workspace, then this is just a data point to help MS solve the BUG. 

Sorry, but I don't see it as a viable work-around. I have too many Workspaces with various settings, Dashboards, links, color schemes, etc. that would all have to be recreated to solve something that A) did not happen a year ago, and B) should have been fixed when it was first reported. 

[StianHog]

Okay. But it the reshare access is retrived from another access setting on app update? Where can the base reshare access be set? 

As for now, all users get reshare on every update. This is a major issue. 

[ToddChitt]

@StianHog I'm with you. 

@Microsft: Please consider CHANGING THE DESIGN SPECS. You did it for the Filter Pane. You did it for a lot of things. 

This is a security BUG, pure and simple!

[StianHog]

We have the same problem. The reshare access returns every time the app is updated. Both a security risk and annoying. Please fix!

[v-shex-msft]

Hi @ToddChitt ,

Can you please explain more about your operations and scenario? It is hard to troubleshooting without any detail informations.

How to Get Your Question Answered Quickly

Regards,

Xiaoxin Sheng

[ToddChitt]

@v-shex-msft 

Thanks for the reply. To clarify my steps:

1) Open an App Workspace, expand it to see all content, specifically the DATASETS

2) Click the elipsis next to a DATASET and select MANAGE PERMISIONS

3) In user the list, take one user that has "App, reshare" permissions, click the elipsis and select "Remove Reshare"

4) Click Update the App.

5) On the Permissions tab, verify that the name above is listed to be given access to the app. Also verify that all the check boxes (on the Permissions tab) are un-checked. 

6) Go back to the Datasets area under the Workspace, for the same dataset, same user. 

7) Notice that the user is back to having "App, reshare" permissions. 

Question: How to I keep a User from having RESHARE permissions? It keeps coming back. I want them to have App permisions and no more. Am I doing something wrong? Am I missing a SAVE step somewhere? Is this a bug? Is it by design?

[AndyWald]

I am having the same issue.  Following the same steps as ToddChitt.  This seems to me to be a new bug since when I initially set up the permissions a few weeks ago this was not happening.  

Is there any resolution or way for me t keep the Reshare permissions disabled when publishing the app?  

[GilbertQ]

I can see the same thing happening.

The only thing I could think of, is if the App is the only way for the user to consume the report then they cannot actually reshare the App or reports/dashboards.