Issue sharing an App or Report to user WITHOUT giving BUILD permissions

[bwarner87]

Goal:

Share an app OR report to the entire organization where users will NOT be able to build on the underlying datasets that use composite model (i.e. Mixed) AND direct query to chained Power BI Datasets. It seems it should be possible when reviewing the cited documentation below for composite model and direct query on a workspace with premium capacity

Issue:

When a user that has direct access to an app views the report, they first are prompted by a schema message (issue image #1) and then the visuals do not load on the report page (issue image #2) and when you click on see details you get another issue popup (issue image #3)

Issue Image #1

Issue image #2

Issue Image #3

Note: I CAN get the user to see all the app content with no errors, but I must make them CONTRIBUTOR or higher on the WORKSPACE for the app and I do not want to give them that high level of permission. Also, I have an Admin in my workspace that confirmed he sees fine as well.

I did review the following sources in helping troubleshot with multiple tests and multiple users but could not land on a solution for read level access distribution of the app or report.

• Setting the right permissions for users of composite models - SQLBI
• Update to required permissions when using composite models on a Power BI dataset | Microsoft Power B...
• Using DirectQuery for datasets and Analysis Services (preview) - Power BI | Microsoft Docs
• Publish an app in Power BI - Power BI | Microsoft Docs

Also, I think this might be related to this post

• Couldn't Load Data for this visual - Microsoft Power BI Community

Tests I have tried with no success for users in my organization where I believe we are all on premium capacity

1. [FAIL] User has direct access “App” for the dataset “Workforce Dashboard(Updated)” tied to app after giving user level access to on 3rd step of app build before publishing; READ access on Power BI dataset “Compensation Dashboard”; READ AND BUILD access on Power BI dataset “People Hierarchy”

1. [FAIL] User has direct access “App” for the dataset “Workforce Dashboard(Updated)” tied to app after giving user level access to on 3rd step of app build before publishing; READ and BUILD access on Power BI dataset “Compensation Dashboard”; READ AND BUILD access on Power BI dataset “People Hierarchy”
   
   
2. [FAIL] User has direct access “App” for the dataset “Workforce Dashboard(Updated)” tied to app after giving user level access to on 3rd step of app build before publishing; READ and BUILD access on Power BI dataset “Compensation Dashboard”; READ AND BUILD access on Power BI dataset “People Hierarchy”
   
   
3. [FAIL] Removed users from the app direct access and created a shareable link-> User has shared link access to the APP “Workforce Dashboard(Updated)” for the dataset “Workforce Dashboard(Updated)”; READ and BUILD access on Power BI dataset “Compensation Dashboard”; READ AND BUILD access on Power BI dataset “People Hierarchy”

App Details

• Created in the workspace “Workforce Reporting [Production]”
• Has one audience
• Only is publishing 1 report “Workforce Dashboard(Updated)”

Workspace Details

Name: Workforce Reporting [Production]

Other notes

• Workspace does NOT appear to be a classic workspace
• It is the final workspace using pipelines
• It contains all 3 datasets tied to the published app
• It is part of the premium capacity
• See settings screen grab

Dataset Details

1. Workforce Dashboard(Updated)
   1. Only has one data source connection as Direct Query to the Power BI Dataset named “Compensation Dashboard” located in the same Workspace
2. Compensation Dashboard
   1. Is a composite / mixed mode where it has import for a bunch of data sources
   2. Additionally, it has a direct query for the Power BI Dataset named “People Hierarchy” located in the same Workspace.
   3. Has RLS
3. People Hierarchy
   1. Exist in the same data workspace

See data lineage view

[bwarner87 · Accepted solution]

I was able to narrow in on the issue. In short I needed to add users to a group in RLS on one of the Power BI Datasets that is a direct query data source in the chain. 

For reference 

Dataset permissions - Power BI | Microsoft Docs

[MarkPalmberg]

Fantastically detailed request, @bwarner87 . I'm here this morning looking for info on how to give users edit access to a Scorecard in a workspace without giving those users at least Contributor direct access to the workspace, which then gives them access to a report in the same workspace that I do *not* want them able to access. I'm setting up audiences, but that doesn't seem to be my solution. I hope any replies to your message help me as well. Thanks for doing this work! And good luck!