Completely confused by Power BI Premium / Security

[Anonymous]

Power BI community, we’ve just purchased our premium license to Power BI, and we’re running in to some security issues which are highly confusing. The specific tests were doing:

• We’ve created a workspace and app and assigned them to a dedicated Premium Capacity
• We’ve given workspace members the “Members can edit Power BI content” right
• We’ve added a NON-PRO user (aka consumer) to the workspace

The behaviors we’re seeing are:

1. In the service, the user can DELETE reports, even reports not created by them. – we expect this
2. In the service, the user can NOT DELETE data sets. – we do not expect this. Why can a user delete reports but not data sets???
3. The user can log in to Power BI desktop and use “get data / Power BI service” to access the data set, and create reports in Power BI desktop – we expect this
4. In the service, when the user clicks on the CREATE REPORT icon, they get the “you must upgrade to pro” message – we expect this (I guess)
5. In Power BI desktop – the user can PUBLISH A REPORT to a workspace – we do NOT expect this. And/or it’s completely in contrast to item #4. Why can a user NOT create / save a report without being a pro user from within the service, but they CAN publish a report to the exact same workspace from Power BI desktop???

Last and not least - we flip the workspace from members having "Members can edit Power BI content" to them only having read only access. When we do this - our test user is no longer able to log in to the workspace at all - he gets the "you must upgrade to pro" message immediately. And he's unable to see the data set through Power BI desktop. I thought purchasing Premium was supposed to allow non-pro users to see the content. If not, why are we paying for this?

Just trying to understand the behavior we’re seeing - it's very confusing.. Thanks in advance for any help!

Scott

[GilbertQ]

Hi Scott,

With regards to your questions, when you are adding users to the App Workspace, are they free users or Pro Users?
Also is it only free users who are trying to create a report?
Or is it also Pro users who are in the App Workspace who are trying to create the report?

I am trying to better understand which users are where?

[Anonymous]

Hi GilbertQ,

all of these tests were performed using a free (non-pro) user. Haven't gotten to testing the pro users yet!

Thanks!

Scott

[GilbertQ]

Hi Scott,

As far as I understand it a Free user will be able to upload a report and even possibly share it, if the App Workspace is on a Premium Capacity.

All the other questions you mentioned are working as expected?

[Anonymous]

Hi Gilbert, not sure how to answer "are other questions working as expected". I think if I boil down my test cases, it comes out to a couple of fundamental principles I just don't understand:

- Edit vs. Read Only membership - I expect "Read Only" membership to allow users to see reports and data sets, but not change / delete / add new ones. I expect "edit" membership to allow them to change/delete/add. This appears not to be the case - if the workspace is "read only" for members, then in Power BI desktop they can't even see the datasets using the get data "From Power BI Service" option. But if workspace is set to "edit" they can. So it seems that "Edit" vs. "Read Only" is not just controlling the read/writeability - it's actually removing access completely when set to read only?

- Power BI Desktop vs. Web interface - I expect permissions to work the same in the desktop tool vs. in the web interface, but this also appears not to be the case. With workspace membership set to "edit", a non-pro user in Power BI desktop can use the dataset with "get data from Power BI service", create a new report, and then publish that report into the workspace. But through the web interface, a non-pro member can't click on a dataset and choose "create report".

I'm at a loss how to explain this to end users...it should be very simple, rules like "read only access means you can read only and not change", and "non-pro users can't publish, pro users can". But both of these statements are demonstrably false, and in ways that don't make sense to any logic I can see.

I'm hoping there is some simple "point of view" that once pointed out to me, this will all magically make sense. But my current suspicion is that things just don't make any sense, and I'm going to be stuck trying to train users on things that contradict themselves.

Sorry, not intending to rant...but how hard can this be?

Thanks,

Scott

[GilbertQ]

Hi Scott,

What I would suggest is the following.

If you want a set of users to edit or create reports then put them into the App Workspace members.

If you want a set of users with read only access to reports, create an App and deploy them to the end users.

I know that currently the App Workspace is not crystal clear in terms of what will work and what won't.

But by doing the above there is a clear distinction between where users can edit and create and read only

[Anonymous]

Hi Gilbert, your way is a much better way to think about it - but we have three user groups, not two:

1. Consumers - who should be able to just consume predefined reports and dashboards. We'll set these up as non-pro users with access to Power BI applications

2. Data Analysts - aka pro users, with the ability to author reports and dashboards, and create new datasets and/or modify existing data sets

3. Data explorers. This is the part where I don't have a good answer. We want these users to be able to use data sets defined by others (i.e. no ability to update data sets), but to create their own reports as they browse. I'd also prefer if they couldn't write overtop of other people's reports. Right now, if we give them "edit" access to a workspace they can overwrite or delete other peoples reports. I'm unsure how to satisfy what we'd like to do

It's the data explorers I'm really stuck on how to help. I really appreciate your input - any ideas? Thank you for taking the time to respond to these!

Scott

[GilbertQ]

Hi Scott,

It is a pleasure to help you out and hopefully get an outcome.

For the data explorers, what if you had to try change them to be a Member of the Workspace?

[Anonymous]

I think (???) the direction we may go is to have the data explorers actually get Power BI desktop but not a pro license, and then ask them to use the "Get data from Power BI service" to connect to the models...but ask them not to publish anything in the service. Unfortunately, as members of the workspace, if the workspace is set to "edit" then the explorers could overwrite the golden data sets. And if the workspace is set to read only, then they can't see it at all.  

Hopefully MS comes up with more granular ways to control security soon.

Thanks again for your help and ideas! I really appreciate it!

Scott

[GilbertQ]

Hi there

Yeah it is a bit tricky at the moment, but I know that they are working on getting a better enterprise experience.

[Anonymous]

Hi Gilbert, have you seen any timelines on how far away "improved enterprise experience" is? Sometime soon, or are will still months / years away?

Thanks!!!

Scott

[GilbertQ · Accepted solution]

Hi there,

I think it will be soon, but I don't have anything concrete to tell you.

[Anonymous]

Fair enough, thanks for the info!

Scott