Confused about Power BI roles and permissions

[marvzhang]

Hi guys,

I have been maintaining a Power BI Premium workspace in our organization (see below) and would like to manage the roles and permissions. 

However, when I added an AD group with our team members as the role Viewer, it seems they couldn't be able view published datasets in the workspace with Power BI Desktop, even though they have signed in with their AD accounts.

But oddly enough, when I changed the role of the AD group to the higher-level role Contributor, they can see all the datasets in this workspace, and the tab Trusted in your org appeared in the datasets selection dialog (see below).

I am very confused because the document Roles in the new workspaces in Power BI states that the role Viewer can "view and interact with an item" or "read data stored in workspace dataflows" as defined in the roles and permissions matrix (see below). But why the members in the AD group granted the role as Viewer cannot see datasets that are supposed to be accessible yet they are able to view and use them when granted as Contributor?

Hope you would help me.

Thanks!

Regards,

Marvin

[v-yalanwu-msft · Accepted solution]

Hi, @marvzhang ;

You could Manage permissions on dataset.

To open the dataset manage permissions page:

• From the data hub: Select Manage permissions on the More options (…) menu.

The dataset manage permissions page enables you to monitor and manage access to your dataset.

and we could get data from the share.

https://docs.microsoft.com/en-us/power-bi/connect-data/service-datasets-manage-access-permissions

Best Regards,
Community Support Team _ Yalan Wu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[v-yalanwu-msft · Accepted solution]

Hi, @marvzhang ;

Yes, it's okey. according to the offical document:

• Dataset owners can assign Build permission to specific users or security groups on the Manage permissions page. See Manage dataset access permissions for detail.

https://www.fourmoo.com/2020/04/01/power-bi-which-groups-can-be-used-to-set-permissions-in-power-bi/

Best Regards,
Community Support Team _ Yalan Wu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[v-yalanwu-msft · Accepted solution]

Hi, @marvzhang ;

You could Manage permissions on dataset.

To open the dataset manage permissions page:

• From the data hub: Select Manage permissions on the More options (…) menu.

The dataset manage permissions page enables you to monitor and manage access to your dataset.

and we could get data from the share.

https://docs.microsoft.com/en-us/power-bi/connect-data/service-datasets-manage-access-permissions

Best Regards,
Community Support Team _ Yalan Wu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[marvzhang]

Thanks for your reply. Is it okay to grant dataset permissions to AD groups?

[Burningsuit]

Hi @marvzhang 

Normally "viewers" only see Reports and Dashboards in a Workspace, they do not see the Datasets (or other constructs, Dataflows etc.) However they can see the Datasets by going to the "Data Hub"  and from there they can request access. (there is an admin setting "Discover Content" that can turn off this behaviour). They will also see the "Trusted in your org" category in the DataHub. 

If they are given "build" rights on a Dataset in the Workspace, they can connect to the Dataset either from the Data Hub, or from Power BI Desktop. Even though they do not see the Datasets in the Workspace.

Hope this helps

Stuart

[marvzhang]

Hi @Burningsuit

Thanks for your big help!

If I understand correctly, It looks like users should explicitly request access for the dataset permissions. But for reports and dashboards, they do not need. 

We have done some tests and it seems that the team member granted Viewer permission can view workspace datasets on Data Hub, but he cannot request the access because it requires the Power BI Pro license. 

What is the best practice if we would like to share the datasets published by our data engineers to business users so that they can explore the datasets and do their self-service data analyses and reports?

Regards,

Marvin