Power BI offers several points throughout the flow of data where security limitations can be applied. This gives administrators flexibility when deciding who can access workspaces, reports, apps, and specific data within a report. This class covers:

• Workspace security
• Report-specific security
• Audiences within Power BI apps
• Row Level Security (RLS)

Power BI access requirements

To access Power BI workspaces and apps, users need a Microsoft account with at least a Power BI Pro license assigned. Power BI Premium Per User is another option when your reporting requires that type of license.

Managing workspace permissions

Workspace permissions determine who can access a workspace and what they can do with its contents. To view workspace permissions, select Manage Access at the top of the reports list. From there, you can add people or groups and assign an appropriate permission level. Available workspace roles include:

• Viewer: Can view the workspace and items within it.
• Contributor: Can view items and upload or modify some items but cannot manage the workspace itself.
• Member: Has Contributor capabilities and can also give Contributors and Viewers permission to share items outside the workspace and add additional Contributors and Viewers.
• Admin: Has control over the workspace and the users within it.

After choosing a role for a new workspace user, select Add to grant access.

Managing report-specific security

You can also define permissions for individual reports within a workspace. Select the three-dot options menu next to an item and choose Manage Permissions. The Links tab allows you to create sharing links and define who can use them. A link can be configured for:

• People within your organization
• People who already have access
• Specific users

You can also determine whether users can share or edit the report. The Direct Access tab lets you give a user permission to an individual report. This can provide access to the report without necessarily providing access to the overall workspace, depending on the permissions selected. Reports inherit permissions from the workspace by default.

If someone has a link but doesn't have permission to view the report, they can request access from an administrator. Those requests appear under Pending. Shared views also allow administrators to manage views that have been shared through links.

Using Power BI apps

Power BI apps provide another way for administrators to distribute reports without giving users access to the workspace where those reports are stored. Apps can also remove extra controls and clutter that users may not need when viewing reports. The class recommends Power BI apps as a particularly useful way for administrators to distribute reports because of their end-user friendliness and ease of management and troubleshooting. To configure an app, select Create App or Update App. The app configuration includes:

• Setup: Configure general settings such as the app's name and description.
• Content: Choose which reports are included in the app.
• Audience: Define groups and control which report items each audience can see.

Multiple users can be included in an audience. Report items can then be made visible or hidden for that audience using the visibility control. After configuring your audiences, select Update App and publish the changes.

Understanding row-level security

Row-level security, or RLS, lets report creators use DAX to define filters for individual users or groups based on parameters such as username, job title, or other information associated with Microsoft 365 users. RLS is particularly helpful when you want to maintain a single dataset while allowing different groups of users to see different portions of the data.

Creating an RLS role

In Power BI, go to the Modeling tab and locate the Security section. Select Manage Roles. The window displays:

• Available roles
• Tables connected to each role
• Filters assigned to those tables

For example, a Minnesota sales role can filter a state column so users assigned to that role see only records where the state is MN. To create another role:

1. Select Create and give the role a name.
2. Select the appropriate table.
3. Define the required filter.
4. Select Save.

Testing row-level security

Before publishing your changes, use View As to test a role. Select the role you want to test and Power BI displays the report as users assigned to that role would see it. For example, selecting the Minnesota role filters the report to Minnesota data, while selecting the Wisconsin role filters it to Wisconsin data. Once you've confirmed the roles are working correctly, stop the test view and publish the changes to the workspace.

Adding users to RLS roles

After publishing the report, users still need to be assigned to the appropriate security role. In the Power BI workspace:

1. Open the report's Security options.
2. Find the role you want to manage.
3. Enter the user's email address.
4. Select Add and save the change.

The next time that user opens the report, their view of the data will be limited according to the role and filters assigned to them.

Key takeaway

Power BI provides security at multiple levels, from controlling access to an entire workspace or individual report to distributing reports through app audiences and restricting the underlying data with row-level security. Choosing the appropriate security method allows administrators and report creators to provide users with access to the information they need while limiting the information they shouldn't see.