A Power BI app is published from an app workspace and inherits the name of its source workspace. Likewise, an app can only contain content from its source workspace. However, an app does not have to expose all the content of its source workspace. The members of the workspace responsible for publishing and updating the app can utilize the Included in App toggle switch to selectively exclude certain dashboards or reports. For example, two new reports that have yet to be validated or tested could be excluded from the app in its initial deployment. Following the validation and testing, the Included in App property (on the far right of each report and dashboard) can be enabled and the app can be updated, thus allowing users to access the new reports. 

A simple publish (or update) process is available within the app workspace for defining the users or security groups who can access the app as well as adding a description and choosing a default landing page for users of the app. The details of the publish process are included in the Publishing apps section.

The following diagram and supporting five-step process describe the essential architecture of apps and app workspaces:

In this example, the Global Sales app is accessed by the sales team consisting of 200 users, as per the Sample Power BI Project template section in Chapter 1, Planning Power BI Projects. Additionally, the row-level security roles described in Chapter 4, Developing DAX Measures and Security Roles, and the organizational dashboard architecture reviewed in Chapter 7, Designing Power BI Dashboards and Architectures, are utilized by the app.

1. An app workspace is created in the Power BI service and members are added with edit rights to the workspace.
   • Individual members (not security groups) can be added to app workspaces.
2. Members of the app workspace publish reports to the given workspace and create dashboards based on those reports.
   • Power BI Desktop is used to author and publish reports based on a Live connection to a Power BI dataset.
   • Visuals from the published reports are pinned to dashboards, such as European Sales.
     • Dashboards are not required to publish an app.
3. Scheduled data refresh or dashboard cache refresh schedules are configured and the workspace content is validated.
   • As an import mode dataset, the dashboards and reports are updated when the scheduled refresh is completed.

4. A workspace administrator or a member with edit rights publishes an app from the workspace.

• • The app is distributed to one or multiple Azure Active Directory (AAD) security groups of users.

5. Members of the sales team view and optionally interact with the content in Power BI and Power BI mobile.
   • The dashboards and reports would reflect the row-level security roles configured in the dataset.

Certain sales team users requiring Power BI Pro features, such as Analyze in Excel, could utilize the Power BI app as well. Additional content access methods exclusive to Power BI Pro users, such as Email Subscriptions to dashboards and reports, are described later in this chapter.