Permission Required - Shared Datasets

[Anonymous]

Hi all,

Having some issues with users getting access to reports built off shared datasets. The current set up we have is a single shared dataset in it's own workspace (which is premium capacity) and then reports built off that dataset in multiple other workspaces.

The issue seems to be that the user needs to specifically be granted access to the workspace where the original shared dataset is, otherwise all of the visuals containing data show generic error messages. Is this intended? If so this would mean we would need to grant everybody in the business access to this one workspace?

[XavierTrottin]

Hi,

It seems that I have an issue to give access to a dataset.

My use case :
 - Worpskace 1 contains datasets / my user is Viewer on the workspace + Build on specific datasets (as soon as  they are qualified

 - Workspace 2 is the place to publish reports : my user is Member in order to mange the reports

My Issue is that the user, from Power BI Desktop, try to create a report and select the source "Power BI Dataset" but he cannot see the dataset from the Workspace 1.
Permissions are managed my AD Group but I try for a specific user and that is not better.

[tctrout]

This is odd and not expected in my experience.

From what you described, it does not appear that your user has build permissions on the dataset.  In my experience, if a user cannot see a datset from the PBI Dataset within desktop it indicates directly that they do not have build permissions.

[XavierTrottin]

That my point, I am sure this user has a build permission on the dataset but she cannot see them from PowerBi Desktop.

I "solved" my issue temporary because I have add the Contributor permission on the workspace but that is clearly not what we want.

I guess I have to raise a ticket to Microsoft to investigate.
NB: we did a test on a PoC Tenant and this build permission was working as expected. I don"t see the difference with our config.

[tctrout · Accepted solution]

You can leverage the Build Permission to grant the necessary access, which grants users access to the dataset but not to the report contents.  This is much more manageable leveraging AD Security Groups.

Setup:
1.  Workspace A contains Dataset 1.  Access to Workspace A is managed via AD Security Group called AD_WSA.  

2.  User builds Report X from Dataset 1 and publishes to Workspace B.  Access to Workspace B is managed via AD Security Group called AD_WSB

In the above configuration, grant build permission to AD_WSB to Dataset 1 located within Workspace A.  This way users of Report X can see the data in Dataset 1 but not have direct access to Workspace A.

[Anonymous]

Thanks, we've been meaning to move to AD groups for a while, think it's time!