Sharing PBIX file

One of the easiest ways to share a Power BI dataset or report is to share the PBIX file. When you author datasets and reports in Power BI Desktop, it’s stored as a file in the PBIX file format. This file can be shared with other people, either by giving them access to the file storage or sending them the file. While this is easy and doesn’t require a Power BI license (Power BI Desktop is a free product as described in Chapter 2), it does have some governance issues. If you use import mode when getting data into Power BI Desktop and you share a PBIX file with someone, they get full access to all the data stored in the file. They also have full access to the data model and can make any changes to the file, though if they do not have access to the data source they cannot edit or refresh the queries. They can either overwrite your file if they have write access to the file storage or save their own copy if not. Having access to the data and being able to change the report can be a potential security risk and risks the integrity of the analysis. Another potential security issue is if you have applied row-level security (see Chapter 13) as it is only enabled in the Power BI Service, since Power BI Desktop is a development environment with full access and control of the file for authors.

It is therefore not recommended to share PBIX files with someone unless you need them to collaborate on the creation or maintenance of the report or dataset. Safely storing PBIX files and not sending them in email or other file exchange programs is recommended to minimize risk of exposing data to unauthorized users.

Direct sharing

A dashboard, report, and dataset can be shared directly with people, distribution groups, and security groups. For dashboards and reports there are share buttons in many places, but for datasets you need to go into Manage permissions to find the sharing options.

All these options are pre-checked checkboxes. It’s very important to think carefully before using direct sharing and if you do which of the preceding options you want to use. The first thing you need to think about is if direct sharing is the right way to accomplish what you are trying to do. When you do direct sharing, it can be hard to keep track on which dashboards or reports have been shared and with whom they have been shared. The next thing to consider is the sharing options. Do you want those who you share with to have the ability to share with others? You can quickly loose track and control of who the dashboards or reports are shared with. The only way to find out is to open the share dialog and look at the Access tab or access the Power BI Activity log. The next thing to consider is if the users you are sharing with should be allowed to create new content using the underlying dataset. If you keep that checked, users will have full access to the dataset unless you have row-level security, in which case they only see what they are allowed to see. Nevertheless, they will potentially have access to bigger parts of the dataset than intended.

Both these options are pre-checked checkboxes. When you share datasets with other users, you are giving them full access to all the data in the dataset unless row-level security is applied, in which case they only see what they are allowed to see. If you leave the Allow recipients to reshare the artifact checked, you allow them to reshare the dataset to whom they want. This can be undesirable as you can quickly loose track and control of who has access to the dataset. The only way to check who has access is in the Manage permissions dialog or in the Power BI Activity log. If you leave the “Allow recipients to build new content from the underlying datasets” checked, you allow them to build new reports and dashboards based on the dataset. You have no control over what they create, and they have full access to the dataset if there is no row-level security applied. Another big drawback on allowing creation of new content from the dataset when sharing dashboards, reports, or datasets is that you need to be careful with all future changes to the dataset as there might be dashboards and reports that you don’t know about but depend on it. Figure 3-1 illustrates direct sharing.

Directly sharing a Power BI report or dashboard is a method that should only be used in certain circumstances. It’s not recommended unless the receivers are few or if you need to share one or few reports/dashboards out of a workspace with many reports/dashboards. Direct sharing is not recommended from My Workspace as the user who owns that workspace is the only person who can access it. If that person leaves the company or is for some reason not able to log in, there is no way to maintain dashboards, reports, and datasets in the workspace. The main drawbacks of direct sharing are that it is difficult to keep track of who has access to them and which reports/dashboards have been shared or not. Directly sharing datasets is only recommended if you need to allow users to create new reports and dashboards from an existing datasets but you cannot for some reason give the user access to the workspace the dataset is in.

Giving access to a workspace

In Figure 3-2, you can see exactly what access each level will give. Note that this list is as of June 2020.

As Figure 3-2 shows, the viewer permission allows the users to view and interact with artifacts within the workspace as well as read data stored in a dataflow in the workspace. The contributor permission allows the same as viewer plus create, edit, and delete all artifacts in the workspace except workspace apps. The member permission allows the same as contributor plus the ability to give access to others (except admin access) and publish and update workspace apps. The admin permission gives you full control over all artifacts in the workspace as well as the workspace itself. The main takeaway here is that all permission levels above viewer allow the user to change and delete most objects in the workspace.

As mentioned earlier the same permission level is applied to every artifact in the workspace. This is a very important information, especially if you give anything more than viewer permission. Figure 3-3 illustrates giving access to a workspace.

Giving access to workspaces for sharing artifacts is best suited for users that need to contribute to the content. Although you can use viewer permission for consumers, it’s recommended to use apps for that as it simplifies maintenance of access.

Apps

The options mentioned are checkmark options with the first two pre-checked. When you share content using apps, you need to consider if you want your users to be able to create new content based on the datasets. This will give them full access to the data in the dataset unless row-level security has been applied. If you allow the user to create new content based on the datasets, you can then allow them to create a copy of the reports in the app. Without the first option, the second option is not available as creating a copy of the reports in the app is creating new content. If you check the last option to allow user to share the dataset, you will need to monitor who has access. This is done on the Manage permission tab of the datasets area in the workspace the dataset is residing or in the Power BI Activity log. All these options make it harder for you to know who has access and what content is relying on the datasets. Make sure that these risks are acceptable before you decide if they should be checked or not. Figure 3-4 illustrates sharing via app.

Apps are the way Microsoft recommends sharing dashboards, reports, and datasets to users in Power BI. Apps allow you to share “packaged” content including multiple dashboards, reports, and datasets with custom navigation, custom website links, and embedded video. The users will always only get view access to the content, although you can give them permission to build their own content using the datasets and reports in the app. Another functionality of apps is that they contain a cached version of the report so that the report in the workspace can be modified without affecting the cached report. Note that the dataset will always be updated in the app if you update it in the workspace.

How should I share content?

When answering the question “how should I share content?” the answer is often, it depends. For larger audience using apps is the best way as it gives you one place per workspace where sharing is done, and you can add custom navigation and support URLs. For smaller audiences or when you need to share part of a workspace to someone, direct sharing might be justifiable, but it should be used sparingly due to the lack of insight into what is shared to whom. Giving access to workspaces to share content is best used for contributors rather than consumers, although the viewer permission allows you to consume content without the option to change.

To simplify your governance strategy, it might be a good idea to stick to one option and say that all content is shared to consumers via apps. This will remove any doubt on what the correct way to share content is, which can be very useful if you have many content developers with different amount of experience. In Figure 3-2 you see how a typical publish and sharing process might look like. Notice that consumers only have access to the app.

You can embed Power BI reports or apps via secure embedding or via specific SharePoint embedding. We believe that kind of sharing will follow the exact same principles as sharing through the Power BI Service. The only difference is that the content is accessed from a different place.

End-user collaboration

End-user collaboration is when two or more people work together to create insights from existing reports. In Power BI that is done via the Comments feature. Comments allow users to comment on a report or dashboard and the context is kept. The user can also tag other people within the organization in the comment. This way users can collaborate on getting insights. Power BI reports can also be embedded into other software that allows for direct collaboration. It’s not in the scope of this book to discuss all those options.

Contributor collaboration

Contributors can collaborate on creation and modification of Power BI content by sharing artifacts. As discussed in the sharing section of this chapter, there are several ways to share artifacts. Generally speaking, developers which need to collaborate on a set of Power BI artifacts will place them in a workspace and make sure all the relevant developers have at least member access to it. If developers have the appropriate permissions, they can create or modify artifacts. For contributors such as testers that don’t need write access, you would add them as viewers in the relevant workspace. It’s worth noting that there is no true multi-developer capability in Power BI that allows multiple people to develop the same artifact at the same time, as you often can in software development. It’s possible to work on the dataset at the same time as the report is developed if the report is developed on top of a shared Power BI dataset, but otherwise it’s one developer at a time per artifact.

The meaning of promoted and certified datasets is different from organization to organization. It does not come with any functionality except it moves the dataset higher in the lists of datasets in the workspace. Each organization needs to describe when to use which level of certification. By default, every dataset owner can promote their dataset. To give users the ability to apply the certified label to datasets, you need to add them to a group that has the appropriate permissions. It is recommended to have a limited number of people who can add the certify label and be very consistent in what it means for the dataset. Many organizations only certify datasets that are created and maintained by a central business intelligence team and have gone through rigorous testing to verify that the data is correct, but there is nothing to prevent your organization to create your own process for certified datasets.