Access to Datasets and Workspace

[Denis_Slav]

Hi All, 

Could you help to clarify several questions? Because after last updates, i've got a lot of problems with sharing datasets and reports. 

SITUATION:

I've got 2 tenant DomainA & DomainB with users:

• user1@domainA (PRO Liciense)
• user2@domainA (Free liciense)
• user3@domainA (PRO Liciense)
• user1@domainB (PRO Liciense)

QUESTION:

1. Could I give access from <user1@domainA> to READ dataset to <user2@domainA>?
2. Could I give access from <user1@domainA> to READ dataset to <user3@domainA>?
3. Could I give access from <user1@domainA> to CREATE reports in workspace to <user3@domainA> ? 
4. Could I give access from <user1@domanA> to READ dataset to <user1@domainB>?

[TomMartens · Accepted solution]

Hey @Denis_Slav ,

I have to admit, that I'm struggling a little with the meaning of the from in your questions 

like from user1 to user2

First of all, I assume that artifacts (datasets, reports, dashboards) created by user1@domainA reside in a Power BI app workspace "App workspace" and not in the personal workspace "My workplace." I make a distinction between the personal workspace of the single users and the App workspace.

Now to your questions ...

1. give READ permission to user2@domainA
As user2@domainA has only a free license assigned this user also need build permission on the dataset. I always recommend providing access to artifact like reports and datasets using permissions or membership to artifacts instead of sharing access to a single artifact. Build permission is necessary as user2 only has a free license and for this reason can not be added to the workspace "App workspace". 

Now user2@domainA is able to create his own reports using Power BI Desktop and also publish these reports to his personal workspace "My workspace".

2. give READ permission to user3@domainA
A simple yes, as user3 also has assigned a PRO license you can also add this user to the workspace "App workspace", this will automatically include the READ permission to the dataset(s) hosted inside the workspace. user3 needs to be assigned to one of these roles to publish reports to the workspace "App workspace" - Contributor, Member, Admin. If you do not want to add user3 to the workspace you also need to provide the dataset permission "build" to user3.

3. ...CREATE report to user3@domainA
see my answer to question3

4. provide READ permission to user1@domainB
Basically this is possible, but if you are talking about providing access to a dataset, you have to add user1@domainB to your Azure Active Directory as a guest user, then you can assign READ and or BUILD permission to this user, even add this user to a workspace and assign this user to Admin workspace role.
User1@domainB can not create reports based on the dataset and publish these reports to his own workspace, meaning a worskpace outside of domainA.

Hopefully, this provides what you are looking for. 

Regards,

Tom

[TomMartens · Accepted solution]

Hey @Denis_Slav ,

I have to admit, that I'm struggling a little with the meaning of the from in your questions 

like from user1 to user2

First of all, I assume that artifacts (datasets, reports, dashboards) created by user1@domainA reside in a Power BI app workspace "App workspace" and not in the personal workspace "My workplace." I make a distinction between the personal workspace of the single users and the App workspace.

Now to your questions ...

1. give READ permission to user2@domainA
As user2@domainA has only a free license assigned this user also need build permission on the dataset. I always recommend providing access to artifact like reports and datasets using permissions or membership to artifacts instead of sharing access to a single artifact. Build permission is necessary as user2 only has a free license and for this reason can not be added to the workspace "App workspace". 

Now user2@domainA is able to create his own reports using Power BI Desktop and also publish these reports to his personal workspace "My workspace".

2. give READ permission to user3@domainA
A simple yes, as user3 also has assigned a PRO license you can also add this user to the workspace "App workspace", this will automatically include the READ permission to the dataset(s) hosted inside the workspace. user3 needs to be assigned to one of these roles to publish reports to the workspace "App workspace" - Contributor, Member, Admin. If you do not want to add user3 to the workspace you also need to provide the dataset permission "build" to user3.

3. ...CREATE report to user3@domainA
see my answer to question3

4. provide READ permission to user1@domainB
Basically this is possible, but if you are talking about providing access to a dataset, you have to add user1@domainB to your Azure Active Directory as a guest user, then you can assign READ and or BUILD permission to this user, even add this user to a workspace and assign this user to Admin workspace role.
User1@domainB can not create reports based on the dataset and publish these reports to his own workspace, meaning a worskpace outside of domainA.

Hopefully, this provides what you are looking for. 

Regards,

Tom

[Denis_Slav]

@TomMartens Thanks for your feedback. 

I understand, that's my question may be confused and look a little bit noobie. 🙂 I'll try to describe more detail my situation, and I hope you will understood my confused. 😉

Usually, I create to <.pbix> files:

• <DataModel> – content all tables, and measure, etc. With only technical visualizations. There I created base for future use. 
• <Report> – they connect to <Data Model> and content business visualizations. In this file I just use all, which I created in <DataModel>. This file I can give business users, and they can edit neccessary vizuals.

It give me more freedom to create a lot of different reports, based on similar datasets, and give me two independed views to data: technical and business. 

Case 4. (Could I give access from <user1@domanA> to READ dataset to <user1@domainB>?)

Steps:

1. As <user1@domainA> I create new <AppWorkspace>;
2. As <user1@domainA> I created two artifacts:
   1. <DataModel>
   2. <Report> based on <DataModel>;
3. As <domainA> I add <user1@domainB> in Azure AD as a <Guest user>;
4. As <user1@domainA> I add <user1@domainB> to role <Viewer> (the same with other roles) to <AppWorkspace> by steps <Workspace / Workspace access>;

Scenario 1 (Result: FAILD)– As <user1@DomainB> try to open <Report> created by <user1@domainA> and has the error:

Scenario 2 (Result: SUCCESS) - As <user1@domainB> try to open <DataModel> created by <user1@domainA> and it opened without problem.

PS. I suppose, that both scenarios should have the same result. But, as you can see, they didn't. And this problem I get after middle of april 2021.

Also, I can't see <DataModel> when As <user1@domanB> I created new pbix and try to connect to <DataModel> which was shared by <user1@domainA>. 

[aj1973 · Accepted solution]

Hi @Denis_Slav 

To answer your Case 4: When using Azure AD B2B, external users can't access workspaces.

So basicly you need to share Reports or Dashboards with him, or publish it to an App workspace and give him permission as a viewer to it.

Please visit this link https://docs.microsoft.com/en-us/power-bi/admin/service-admin-azure-ad-b2b

[TomMartens]

Hey @Denis_Slav ,

it's still not clear, consider to draw the architecture.

I do not understand what you want to achieve, as I do not understand this sentence:

 give access from <user1@domanA> to READ dataset to <user1@domainB>?

Simply describe what you want user@domainB being able to do and

• the information where a dataset is hosted (workspace)
• the workspace role assigned to user@domainB inside the workspace that is hosting the dataset
• the dataset permissions assigned to user@domainB

Please be aware, that it's simply not possible to use Power BI Desktop to connect to a dataset hosted in tenant domainA when a user signs in using his "email", user@domainB.

Regards,

Tom