Sharing a dashboard to Office 365 groups

[elliottriley]

We want to share dashboards using Office 365 groups.  All our users are Power BI Pro users.

We have multiple Office 365 groups that contain different users and we want to be able to manage users as we do in AD.

Steps we take:

• Create a workspace with a single admin owner
• Create report in that workspace
• Create a dashboard in that workspace
• Share dashboard using individual Office 365 group email addresses (as per Power Bi instructions)

Users already in the Office 365 groups gain access and all works as expected.

When we add new users to the Office 365 group already with shared access to the dashboard, the new users do not get access to the dashboard.  

Steps to overcome this:

• Access the sharing options of the dashboard
• Remove sharing from the specific Office 365 group
• Reshare the dashboard with the same group.

The same steps need to be taken when a user is removed from the Office 365 group.

Is this expected behaviour?

[Quentin]

Hello everyone!
Still having the same problem? 
It seems that i encounter this issue too, new members of lists of distribution O365 group do not have access to Sharepoint Embedded report unless they first enter into PowerBi service.

Is there a workaround for end users that don't need to get familiarised with PowerBi service?

Thanks

[vnaveensln]

Experts,

I am new to Power BI.

We have a dashboard built in Power BI desktop and published to one of the Office 365 groups.

The dashboard has a table and a Pie chart. 

But the users wants to download the dashboard to excel. I am not able to see an option where we can download to excel for the dashboards published on O365 groups.Attached is the screenshot where I am trying to download to excel.

Could anyone please suggest how to download to excel.

Thanks & Regards,

Naveen V.

[sqlchick]

Hi Elliott. You're not crazy. Unfortunately, what really happens is it expands the members to the **individuals** from that AD group you started with. I agree that it doesn't work well at all in terms of alignment between AD and O365 group memberships. I talked a bit about it in this post -- see the Unsucessful Attempt 2 section:  http://www.sqlchick.com/entries/2016/8/6/managing-members-in-a-power-bi-group-workspace

[elliottriley]

Thanks for the response sqlchick.

That's what seems to happen.  It uses the sharing functionality to grab the people in the Office 365 group and give them access at that point in time.  The other issue is if I remove the group from the dashboard sharing, you would have thought that the access would be removed.  It doesn't seem to be.  I've given it probably 18 hours (in case I needed to give it some time), but individuals in the group I removed yesterday afternoon still have access this morning.

There must be a way around this?  How is everyone else managing to use Power BI securely?

The only way I have found is if you use a Power BI App.

Steps to follow:

• Create a workspace (and only admin of workspace has access)
• Create the report in the above workspace
• Create the dashboard in the above workspace
• Create the app from the workspace and point it to the dashboard
• Give the Office 365 groups access to the app
• Publish the app and share the link

If you then add someone to the Office 365 group post sharing/publishing the individual is added, the same if you remove someone.  I just don't know whether this functionality will be changed in the future!?!

I'm not sure whether to report it as an issue or whether it is an expected behaviour?

[sqlchick · Accepted solution]

The sharing story is still evolving for sure. Apps are currently the recommended way to distribute to a wide audience, so that's a good idea to go that direction.

I don't think the functionality is lit up yet, but Apps will allow you to share directly with an AD group so you wouldn't need the O365 group in the middle unless it gives you other benefits (like the shared OneDrive, etc) -- that's on their roadmap here: https://powerbi.microsoft.com/en-us/blog/distribute-to-large-audiences-with-power-bi-apps/#faq  

In the meantime: At a customer project last year we used PowerShell to extract members from the AAD group and then repopulate the O365 group with the correct members on a schedule (every few hours I think). Unfortunately I departed before that project concludes so I don't have a copy of the finished script to share. I do recall we told the script to detect deletes as well as new members, and we also told it to ignore the admins (because we wanted to manage admins manually) and only manage the members (which we had set to read-only) for the workspace.

[elliottriley]

Thanks @sqlchick, we'll go with Apps and see how it works.  I just didn't want to use Apps and then find that it wasn't the right way to go, although I don't think that there is another way to go at the moment!

That link you mentioned is where I saw the Apps suggestion and thought I would try it.

Currently it "seems" to work using them, but we are testing every eventuality of adding / removing / updating users to confirm our thinking!  We still need to test gateway data refreshes to ensure that data is updated within the Apps once set-up - it seems to work with static data refreshes.  We also want to test the functionality of being able to use Power BI Service as a dataset source for multiple reports to save on dataset space.

One thing I'm hoping it will still be able to achieve is RLS within specific reports to filter visable information for specific users.

Thanks for your help so far!

[Seth_C_Bauer]

@elliottriley I had to read through this again to clarify context in my head, but I think I'm there now. @sqlchick Have you seen this with using AD Security groups as well? I've always used those for sharing and don't recall ever encountering this issue. (I initially assumed this is what we were talking about, but its the O365 groups). 

[elliottriley]

@Seth_C_Bauer we've not seen this user AD groups as we aren't using them.  We have an on premise AD which syncs to O365 and some of the users who need access to Power BI are solely O365 Power BI users (as they are external to our on premise AD).  The way to go was to use the O365 groups and add both the on premise synced AD users and the solely O365 Power BI users, then share the dashboard to that O365 group.  Works only the first time of sharing and if a change is made, it doesn't dynamically update.  If you remove someone from the O365 group, the only way to stop sharing is delete the dashboard and create it again, then reshare it.  

[Seth_C_Bauer]

@elliottriley I certainly hope not, it would defeat the purpose of using AD groups if I had to go back in everytime and re-do it... I would submit this as an Issue

Have you also tried to share the link directly with the end user?

Have you checked after a longer period of time? 

[elliottriley]

Hi @Seth_C_Bauer

I've tried both sharing the link with the users direct and I've left it for a number of hours and neither seem to work everytime.  It is very intermittent in the way it works.  Worst thing is if you have removed an Office 365 group from the sharing and the users still seem to have access - that's not great.