Security - share only certain Rows AND certain Tabs with users

[mmace1]

I've been told we want to share a subset of a report with a group of external users.

• We only want them to see a subset of the rows (Row level security!)
• We only want them to see a subset of the tabs

First attempt: Copied the report to a new workspace, removed the unwanted tabs, filtered data down (just via the interface, no row level security) to what was wanted. Publish app, give access to external users:

Problem: Error message about them needing permissions to the underling datasets.

OK:

• I could give them access to the underlying report & use row level security to limit them to only the rows we want. Then (I assume) my app would work. Everything would be great within the App.
• But then they'd also have access to the underlying report...which defeats the purpose of the 'hide these tabs' requirement.
  
  

Options?

[swise001 · Accepted solution]

@mmace1 

This problem...

Copied the report to a new workspace, removed the unwanted tabs, filtered data down (just via the interface, no row level security) to what was wanted. Publish app, give access to external users:

Problem: Error message about them needing permissions to the underling datasets.

 is caused by the target users not having "Read" permission to the source dataset.  Once they've been provided this permission (in the dataset- "manage permissions" menu) - they will be able to see the app that you just created.  Savvy users may figure out how to 'undo' the filters you set with the interface - but if you hide the slicer from view using the selection pane - you can maybe avoid having to setup RLS.  

RLS is setup in the Power BI Desktop file - and if done correctly - you won't have the 'filter the data down' in the report canvas - because your security rules and roles will do that for you.  This will require a bit more work on your part to set up the file - but should have the desired effect.  

Either way - you'll still need to add the report viewers to a dataset permission role - in order for them to stop getting that error.  

"Error message about them needing permissions to the underling datasets."

[mmace1]

@swise001 Instead of Viewer, they can be given Read persmission to the dataset role, right? 

[swise001]

@mmace1 

Viewer means they have access to the workspace - as a viewer - which is basically 'read-only'.

"Read"  means that don't have access to the workspace (so they won't see the workspace if they look for it)- but they will be able to access reports/apps built off of that dataset.  

They are essentially the 'same' permission - except that Viewers are able to see the workspace in their Power BI account and 'see' any reports you have in there.  You can switch Viewers to Read by removing them from the workspace access - and adding them to the Dataset permission.  

[mmace1]

@swise001 

I added the group with Read Access to the underling Dataset.  They're still getting the error that they don't have access to the underlying dataset. 

Do I *have* to click this option? 

Just to recap, right now I have: 

• Dataset A in Workspace A
• ExternalUsers Group has read permission to Dataset A
• Dataset A has row level security - with Externalusers given access to a subset of the rows
• Report A, which uses Dataset A, copied over to Workspace B. Unwanted tabs removed
• App B published from Workspace B, and access given to External Users

[swise001]

@mmace1 

You don't need to give users "build" access.  That only pertains if they intend to 'build' their own reports using the same dataset.  

At it relates to accessing the App (and its data) - it sounds like you've done everything correctly. 

1.  Users have access to the dataset

2.  Users have access to the app

3.  Users are included in a RLS role at the dataset (otherwise it would tell them it's restricted)

This all lines up pretty well.  

The dataset connection to the App should be automatic and immediate - but you could always double-check by updating the app (or unpublish and republish it). 

[mmace1]

@swise001  Works now!

So it was a time delay thing.  Since everything in the cloud takes between 0- 30 minutes to take effect.  The future is now. 

Thanks!

[v-zhenbw-msft]

Hi @mmace1 ,

Please refer the following post and articles, hope them can help you.

https://community.powerbi.com/t5/Service/Row-Level-Security-External-User/m-p/756857

https://www.sqlservercentral.com/blogs/how-to-get-power-bi-rls-to-work-with-external-users

https://superfarb.com/power-bi-row-level-security-while-sharing-with-external-users/

Best regards,

Community Support Team _ zhenbw

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Greg_Deckler]

@mmace1 - Check out Guy in a Cube  ( @GuyInACube ), I vaguely remember them covering some kind of crazy automatic page security or something.