To follow this Fast Class, you’ll need a Power BI Pro license, along with Power BI Pro licenses for users who will view the reports. You’ll also need permission to create security groups in Microsoft 365. If that permission is restricted by your IT administrator, work with your IT team to create the groups you need.
Create Microsoft 365 security groups
Start in the Microsoft 365 Admin Center. Go to Teams and Groups, then Active Teams and Groups, and open Security Groups. Create an admin security group, followed by security groups for each department or access level you need. Once the groups are created, add the appropriate users to them. Using security groups makes ongoing administration easier. Instead of managing individual users separately within each Power BI report, you can manage membership through the groups.
Create a Power BI workspace
Next, open the Power BI service and create a new workspace. In this example, the workspace is called “Company Reports” and uses Power BI Pro. Once the workspace is ready, return to Power BI Desktop and publish your report to that workspace. After publishing, refresh the workspace in the Power BI service to see the report.
Configure scheduled refreshes
After publishing the report, configure its refresh schedule. Select Schedule Refresh on the semantic model to open its settings. From there, you can:
- Enable scheduled refreshes.
- Set the appropriate time zone.
- Choose the times when the report should refresh.
With a Power BI Pro license, the report can be scheduled to refresh up to eight times per day.
Set workspace access
Return to the workspace and select Manage Access, then Add People or Groups. Power BI provides four workspace access levels:
- Admin: Full access to the workspace, with the same rights as the workspace creator.
- Member: Can manage reports, update security settings, and publish updates to the app.
- Contributor: Can upload and edit reports but cannot make security or management changes or publish updates to the app.
- Viewer: Can view reports but cannot access management settings or underlying data.
For end users, use the Power BI app rather than giving them Viewer access to the workspace. Treat the workspace as the back end where developers and administrators manage content, and use the app as the place where end users consume reports. It is also recommended to have an admin group or multiple people with admin access to your Power BI workspaces, unless you use a dedicated account to host company reports.
Connect security groups to row-level security
Once administrators have workspace access, map departmental security groups to the row-level security roles in the report. Open the report’s semantic model, select More Options, and then select Security. Add each appropriate security group to its corresponding row-level security role. This approach allows group membership to determine users’ Power BI permissions instead of requiring administrators to manually add and remove individual users from every report.
Test row-level security
After adding the groups, test the setup by selecting More Options and then Test as Role. Security testing mode lets you review the report from the perspective of different roles or users. For example, an administrator can verify that an admin sees all applicable data while each department sees the view provided by its row-level security role. Users who need to edit row-level security mappings must have at least Member access to the workspace.
Create the Power BI app
With report security configured, return to the workspace and select Create App. You can give the app a name and description and customize options such as its logo and theme color. Under Content, add the reports you want included. Next, configure the app’s audience. An audience determines which reports its members can see. Add the appropriate security groups to give their users access, then publish the app. Power BI provides a link that you can distribute to users for access.
Create different report experiences with audiences
App audiences can be used when different departments should see different combinations of reports. For example, if Departments One and Two should see only a company sales report while Department Three should see that report plus its own sales goals report, you can create a separate audience for Department Three and make the additional report visible only to that audience. This lets users access the reports intended for them through the same Power BI app while controlling report visibility by audience.
Manage users through Microsoft 365
Once the app, audiences, security groups, and row-level security are configured, ongoing user administration can largely happen through Microsoft 365 security-group membership. Users can be added individually through Active Users, or multiple users can be added through the Security Groups area. Incorporating security-group assignment into your new-user onboarding process can simplify access management.
Publish report updates
When you make changes to existing reports or add new reports, update the Power BI app so users receive the latest versions. Users with Contributor access or higher can update and publish reports to the workspace. Only users with Member or Admin access can push those updates to the app.
Key takeaway
Power BI apps provide a clean way for end users to consume reports, while workspaces serve as the administrative back end. By combining Microsoft 365 security groups with row-level security and Power BI app audiences, you can manage which users have access and which reports and data they can see, while simplifying ongoing user administration.
