New App Experience Audience - 'Could not connect to the data source

[Nathan_C]

Have recently only began our evaluation of the new App Audience experience and were looking to leverage this feature to suppress reports for specific user groups (Active Directory) on the same workspace.  The configuration of our testing App included only two audience views.  The first included all reports on the workspace (1 Power BI and 1 Paginated Report) and was setup to permit access to the workspace users, which was limited to our development team, and our primary business contact (named user) was extended access through the app (so no access permission on the workspace).  The second audience only included the paginated report, and was setup to include the workspace users and a user group which contained our primary business contact as well as all of the identified users. 

Our business contact had no issues accessing the app and its content, though member of our second audience encountered the 'Could not connect to the data source' error for the paginated report.  Image of error notice embedded >>

The dataset used was a composite model which leveraged a DirectQuery on an on-premise data source, a public accessible XML feed from a web service and a data table entered directly through Power Query.  From our knowledge none of these source would hit Analysis Services. This dataset was used for the source of both the Power BI and paginated report. 

Adding the user group with Viewer access on the workspace resolved this error, but this scenario also exposes the full content of the workspace to the user group, is less than desirable, and would discourage our implementation of the Audience functionality for future reporting.

Through our investigation it would appear that the audience configuration of the second view would periodically lose the permissions for the Active Directory user group used to secure the view.

Suggestion would be to ensure that the App Audience functionality accepts and applies Active Directory user groups to secure views independent of the user group requiring access to the workspace.

[v-mengzhu-msft]

Hi @Nathan_C ,

If you would like to suggest some feature improvements. I have found users with similar needs to you here  Ideas (powerbi.com) , you may vote the idea and comment  to improve this feature. It is a place for customers provide feedback about Microsoft Office products . What’s more, if a feedback is high voted there by other customers, it will be promising that Microsoft Product Team will take it into consideration when designing the next version in the future.

Best regards,

Community Support Team Selina zhu

[Nathan_C]

Hi Selina (@v-mengzhu-msft),

Thank you for the suggestion of posting to the ideas setcion of the forum, but I do believe that this is a issues with the implementation of the App Audience feature, as it does note in the 'Manage Audience Access' setup pane that you may enter a user or group.   

This is also referenced in the feature launch blog post and Whitepapers on the feature:

• the author can specify which groups or users should be added to the current audience group
• Authors can decide which workspace content is shared with specific users and security groups

We have not be able to successfully implement an App Audience using a AD security group. When applying an update to App Audience using a security group, when the App Update is reentered afterwards, the assigned security group is no longer listed on the Manage Audience Access pane.

[bahrak]

I've got the exaxt same issue. Following this thread

[Nathan_C]

Hi @bahrak  and @v-mengzhu-msft,

In some testing we are noticing the issue occuring with AAD groups with a scope of 'Global' which in our configuration also do not have an associated email address.  Could the configuration of the security group be the underlaying issue, considering the requirements and functionality of the App Audience feature?

Putting it out there, as we have not yet validated this theory with our own security team.