Security, Roadmap for Workspaces and App

[calyps]

Hello All,

I need some advice. Basically, we are rolling out a Power BI project internally. The way we have structured is different groups within the company have different workspace and each workspace has its own set of reports and dashboards.

I want business users to only be able to access the reports and not make any changes to it. Not even pin it to dashboards. I thought the best idea is to create app and give users access to apps with active directory group. So a business user will have access to App but not the workspace however, if i apply this logic the user can see the apps but not the reports within the app. If i give them read access to workspace, they can see workspace as well (which defeats my purpose).

So my question is, what is the best known method for such an implementation? Is there a roadmap for it that i need to consider?

Thanks,

[calyps]

Thank you both. Some usefull insights however, it still do not answer my question on the best practices? Why do we have app at the first place if we cannot control access to the app on its own? 

[v-yulgu-msft]

Hi @calyps,

Are you attempting to share App to those business users who are not members inside a App Workspace? If that is the case, you can distribute different apps to different users via grant access. Recipients have no permission to edit the content inside App.

Regards,
Yuliana Gu

[v-yulgu-msft]

Hi @calyps,

You can grant only view permission to your workspace members. Then, they are not able to publish reports, edit report or pin to dashboard.

Best regards,
Yuliana Gu

[nkkinariwala]

I have created an app and it works fine and nicely integrated with active directory and security groups. 

You can choose a landing report.. You can browse all the reports using top right horizontal lines icon (View content list) and using that, you will be able to see all the reports. 

What I have done is, I created a landing report and I am providing hyperlinks for all the reports. (I am making sure to provide the hyperlink of published report on an app and not from workspace).

Workspace I am restricting to owners of the reports and I am driving all the users through an app