Gateway Admins not allowed to USE individual Data Sources

[ToddChitt]

Hello,

Why must every Data Source within/under a Gateway need to have Gateway Admins listed as users before they can reference said Data Source in a Dataset Scheduled Refresh setup?

I saw that I and my colleague were both listed as Admins on the Gateway. I set up several flat file sources under the Gateway. HE went to set up Scheduled Refresh and could not see any of the Data Sources. I then went back to all the Data Sources under the Gateway and added him as a User.

He tried again and was now able to reference those Data Sources.

He is an ADMIN on the GATEWAY itself. Why do those permissions not trickle down to things underneath it. 

Also, there was one Data Source where I was not listed as a User and I could go in and grant myself access. If I can GRANT MYSELF ACCESS as an Admin, why not just give all Admins OF the Gateway rights as Users to all Data Sources by default.

Seems like a lot of stupid overhead. We ended up creating lots of duplicate Data Sources because someone who is an Admin went in to set up Scheduled Refresh, didn't/couldn't see sources already configured, so created duplicates.

I see this as a BUG.

[ToddChitt]

That's a 'defect support system'. Plus I don't have access to the client's AD. It's only three or four people, but it DID result in a bunch of duplicated datasets under the gateway 😞

Honestly, it's like being granted SYSADMIN rights on a SQL Server is not enough to allow you to actually READ any data, and you must ALSO be granted db_datareader Role on each database. If some other SYSADMIN creates another database, you need to be granted read rights there too.

Poor design specs on the part of Microsoft.

[GilbertQ]

Hi there

Yeah I understand what you are saying. It does make sense but this is currently the way it has been implemented.

And if there is a way where each data source gets created to add the relevant users it should not be an issue later.

[GilbertQ]

Hi there

What you can do is when you create the data source, you can click on Users and then add the users who will have permissions to refresh via that data source.

This will mean that each user does not have to be a Gateway Admin.

Below is a screenshot where you can add the users

[ToddChitt]

Sorry, but you're missing the point. The point is that Admins on the Gateway should INHERIT User rights on all Data Sources under that gateway.

I know that I CAN, my point is that I SHOULD NOT HAVE TO.

If I have a Gateway with 50 Data Sources, and I hire a new Power BI guru who will manage my gateway and develop and deploy reports, and I add him as an Admin (so that he can add more if he needs to), currently I must also touch all the 50 individual Data Sources to grant him User rights.

Honestly, it's like saying the sysadmin role in SQL Server Security does NOT also come with db_datareader on every database, and must be added individually for each.

The actula scenario was this: 5 Data Sources were configure by me. Then another Gateway Admin went to set up Schedule Refresh and it indicated that there were no Data Sources to match what he needed. So he created 5 MORE, all DUPLICATES.

If, as we had assumed, the Admin was also be default/inheritance a User on on Data Sources, he would have SEEN them and USED them, instead of DUPLICATING them.

[GilbertQ]

Hi there

Oh ok I understand what you mean.

I can confirm that I am a Power BI Gateway Admin and I have not had to add myself to any data sources. I did create most of them and by default I was added to the users list?

[ToddChitt]

Right.

You get listed as a User because you are the one who created it. 

Now try this: Remove yourself as a User of one of the Data Sources. Then try to use it to set up Scheduled Refresh. You are an Admin on the Gateway but connot see that Data Source in Scheduled Refresh setup.

[GilbertQ]

I know that I would not be able to schedule the refresh because I am not listed under the users.

What I would suggest is to create a AD Security Group which you are both part of. And then when ever a person adds a source they then add this group under the users?

I understand that it might or should be defaulted to all the data source, but I would add this to a process for setting up the gateway data sources.