Live connection permissions - Published Apps

[dbartel]

I have 2 workspace, A and B.  Workspace A has a report with a dataset.  The workspace gets published as an App with the build permission for everyone.

I have a report that gets published into Workspace B that is connected to Workspace A's dataset using the published Apps permissions (build).  

Both 'Apps' are published for the entire organization.  The idea here is that we want a lite version of workspace A's reports in workspace B.  Nothing is sensitive and must be hidden from individuals that use Workspace B.  Individuals who have workspace level access do not experience this issue.  The Entire organization, those without direct workspace access, experience this problem.

OK, now the problem.  For people that have added Workspace A's App(get apps), the live connection works as expected.  Individuals who have just gone out and done a get apps for Workspace B will get a Permission Required error when trying to access the report set in Workspace B that uses Workspace A's dataset.  Now, if an individual  Adds Workspace A's app to their Apps, Workspace B's app will start to work as expected with out the Permission Required error.  

I could ask everyone to add the datasource app and then delete it, but that defeats the whole intent as we are trying to provide the simplest solution to the Lite users (workspace b)

It seems like Workspace B does not know that the App in Workspace A is shared with them until after it is added.  Once added, the App with the datasource can be removed from an individuals App list and Workspace B App still has Access to Workspace A's dataset.  

Is this the intended behavior or is this a bug that only happens when trying to access a shared dataset in another workspace's App for the first time?

[v-robertq-msft · Accepted solution]

Hi, @dbartel 

According to your requirement, the solution that adds a link for access is very smart and useful. And I guess it is the best way to solve this problem at current. Would you like to mark your own reply as a solution so that others who are facing the same problem can learn from it too?

Thanks in advance!

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[v-robertq-msft]

Hi, @dbartel 

According to your description, you created a report in Workspace B which used the dataset in Workspace A(from APP), then you invite the user to the Workspace B’s APP, they don’t have access to the underlying dataset. I think the reason is that they truly do not have permission to the dataset.

You should keep in mind:

When you used the dataset from workspace A to create a report, your report is live connected to the dataset in workspace A. The dataset doesn’t exist in workspace B, so when the invited users in workspace B truly don’t have access to the dataset.

I suggest you to create an Office 365 group for the invited users and add them to the original dataset as a group once at a time or just add them to the dataset one by one, like this:

Create reports based on datasets from different workspaces

Connect to datasets in the Power BI service from Power BI Desktop

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[dbartel]

Thank you for your response. Setting up a group is not an option as these are published to the entire organization and there are thousands of potential users.  This is why we are publishing the 'Apps' to the Entire Organization in premium workspaces.

If the people using Workspace B could never access the App Published in Workspace A's dataset I would agree with the above and be forced to duplicate the datasets (one in each workspace).

However, we have found that if an individual opens the workspace A app once either via an app link or by 'getting the app' from the Apps page, that seems to set a flag somewhere in the background that enables the individual to use the Live Connected data going forward without problems.  Once added or visited, Workspace A never has to be opened again.  The Workspace A App can be removed from an individual's app list without effecting Workspace B's access.  I have been told that if an individual tries to use the Workspace B app from the PowerBI Mobile (iPhone) app it works immediately. I have not confirmed this behavior.  It appears that the Mobile app handles authentication in a different manner.

As a workaround, I have added a link to the Workspace A app in the Workspace B App's Navigation pane and labeled it, Fix Permissions Required problem.  The link will open in a new tab and I have them landing on a dashboard page that tells them that they can close this window now.  The One-time visit seems to clear up the permissions required problem.  Not ideal, but better than maintaining and refreshing 2 copies of the same dataset.

I just saw that there is an upcoming release has the ability to convert a PowerBI dataset live connection to Direct Query.  That might also resolve the problem.