Unable to deselect reshare or build access for links

[fpfl]

I currently share a Power BI report with guest users via a link. I have row-level security set up for every guest user. Initially I set the access to be read, reshare and build, but when I want to deselect reshare and build access here:

this pops up:

Would greatly appreciate it if someone could advise!

Thanks!

[edhans]

Can you ensure everyone you have shared the report with is still set up on the Active Directory? I saw this issue come up recently and it was because there was an "Unknown User" it was shared with - someone that had been deleted. If that is the case, remove that person, then try to update the settings.

[fpfl]

I tried removing everyone from the Power BI link access and adding them back one by one, but still the same error message when I tried to add back the third account (originally 60 people on the link).

[fpfl]

Ended up sharing to specific users again:

I really hope Manage Access in Manage Permissions could work smoothly though. Don't want to have to remove everyone and add them back each time I want to make some updates to access

[edhans]

You need to have a security group created for this. It is generally bad practice to share reports and other Power BI artifacts with email addresses for just this reason. Use Office Groups (like those that are a member of an Outlook group or Team) or security groups that can be set up in the Azure portal.

I suspect the issue was some change happened to a specific user in AAD and that caused the issue. This would not have impacted the sharing with groups.

[fpfl]

Thanks for the answer!

Would you suggest creating an Azure group for each row-level security group in Power BI, and add that group email address to row-level security?

[edhans]

That depends. If RLS if for groups of people then yes, it is MUCH easier to manage. I do that quite often. Then as people move into or out of those groups, RLS just works for them.

If it is more complex than that and each person has their own setting, then many groups with 1 person in them doesn't make much sense, and something along the lines of this article would be better. Dynamic Row Level Security with Power BI Made Simple - RADACAD

But if it is groups, then yes. Then the HR department effectively changes who sees what by moving them into/out of security groups through IT department tickets.

[fpfl]

I see - so if I create an Azure group for each RLS, do I share the Power BI dashboard with that group email, and these users in the group will have access to the dashboard through their own email?

[v-easonf-msft · Accepted solution]

Hi, @fpfl 

Yes, you can create group for each RLS and these users in the group will have access to the dashboard through their own email.

You can use the following groups to set up row level security.

• Distribution Group
• Mail-enabled Group
• Security Group

See the tutorials below for details.

Row-level security (RLS) with Power BI 

use GROUPS with Power BI Row-Level Security (RLS) 

Best Regards,
Community Support Team _ Eason