Managing Access at a Dataset Level, App not Discoverable

[Anonymous]

Here is the scenario:

In Workspace1, I have datatset1 and dataset2. I want user1 and user2 to interact with reports based on their respective datasets in the same app. But, I don't want user2 to see dataset1 or user1 to see dataset2. 

So, here's what I did:

1. Publish dataset1 and dataset2 to Workspace1
2. Under Datasets, I click on manage permissions for dataset1
3. I add user1 and uncheck build and reshare permissions (read access)
4. Same thing with user2 and dataset2
5. I grant admin access to the IT support group at the workspace level
6. I publish the app, with the permissions set to specific individuals and groups, and don't add any users or groups

The result: sometimes user1 is able to find the app and add it, and the desired results is achieved: user1 can only see report1(dataset1) tabs, and cannot navigate into report2(dataset2). More often, however, user1 is unable to see the app.

What do I need to change so that user1 can access the app, but only see dataset1?

Note: when I add user1 to the app when I go to publish, user1 is automatically added to dataset2. 

[v-alq-msft]

Hi, @Anonymous 

As is said in official document, Power BI introduced Build permission in June 2019 as a complement to the existing permissions, Read and Reshare. All users who already had Read permission for datasets via app permissions, sharing, or workspace access at that time also got Build permission for those same datasets. They got Build permission automatically because Read permission already granted them the right to build new content on top of the dataset, by using Analyze in Excel or Export.

If you check the option to 'Allow users to conncet to the app's underlying datasets' when publishing an app, you are giving app users Build permission on those datasets. When you clear this option, new users you add to the app don't get Build permission. However, for existing app users, permissions on the underlying datasets don't change. You can remove Build permission manually from app users who should no longer have it. Please check your steps when publish the app.

For further information, you may refer to the following links.

https://docs.microsoft.com/en-us/power-bi/service-create-distribute-apps#allow-users-to-connect-to-datasets

https://docs.microsoft.com/en-us/power-bi/service-datasets-build-permissions

Best Regards

Allan

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[GilbertQ]

What if you give user 1 the link to the App?

What happens then I am really interested to see how this pans out.

[Anonymous]

Yep, so we have tried the link to the app and to the report, and in both cases user1 gets the message that they don't have permission to the app.

In other words, the dataset permission doesn't flow to the workspace and then to the app like we expected.