Quick tip: Sharing Power BI Dataflows

Problem

What rights does a user need to access a Power BI dataflow?

Just a quick post on Power BI dataflows after I saw this question on the Power BI Community forum about sharingdataflows - only via member/contributor permission?.

The user on the forum wants to know how to share dataflows with other users with the least privilege possible.

From my testing, it seems you need to provide people Contributor/Member/Admin to the workspace with the dataflow. If you choose the lowest permission Contributor - then they can't edit the dataflow BUT they can take over ownership and change the scheduling ! Not Good. I just want people to be able to connect to the dataflow.Have I missed anything ?

I thought this was just an easy lmgtfy-question, because there are already a lot of sources on dataflows:

• Matthew Roche (B | @SQLAllFather) wrote extensively about dataflows in Power BI, covering dataflows documentation, a whitepaper, Overview posts and much more.
• Reza Red wrote some good posts on dataflows with the use cases of dataflow being the best in my opinion.

Returning to finding the answer to this question, it turned out it wasn't that easy. There even is an open issue on the documentation on GitHub to add this information to the docs. So I ended up testing it myself.

Solution

To access a PowerBI dataflow you need either

• access to the workspace the dataflow resides in as an Admin, Member or Contributor, or
• Viewer role access to the workspace

Option 1, edit rights to the workspace, might not be desirable for your use case. But we have one other option: the new Viewer role that was introduced back in June of this year can also be used to share dataflows. I already wrote about the new Viewer role in PBI Desktop earlier.

When you are granted Viewer role access to a workspace where a dataflow is created, you can connect to and use that dataflow in Power BI Desktop:

Final thoughts

On a dataset you also have the ability to give the Build permission to give someone access to create content from that dataset (e.g. reports, dashboards, pinned tiles from Q&A, and Insights Discovery, but also content outside Power BI). This feature is still in preview however at the moment of writing. As the documentation says: Build permission is only relevant for datasets, for now? :-)

There is an idea that sounds like the Build permission on dataflows: Dataflow Permissions to give access to an individual dataflow.

Maybe the Build permission will also be added to dataflows in a later phase?

The New Power BI Workspace Viewer Role Explained

Back in April of this year Microsoft announced the rollout of a new Viewer role in Power BI workspaces. It is mentioned in the release notes of April of this year: Power BI Planned features

On June 25 the Power BI team announced therollout of the new Viewer role for Power BI workspaces.

This is all part of the newworkspace experience, which in fact is not that new anymore :) It in fact has become the default workspace you create, there will be a plan to migrate old workspaces to the new ones. You can read the docs on howthe new workspaces are different or on workspacefeatures that work differently.

As of now we have 4 roles available in a Power BI workspace. The new Viewer role works quite the same as the classic workspace option "Members can only view Power BI content". It gives a read-only experience to the users.

A few remarks that weren't totally clear for me in the beginning:

• You can have read-only access to the content in the workspace without publishing an app.
• The Viewer role does requires a Pro license or your content must reside in Power BI Premium capacity. That way it behaves the same as the published app on a workspace in Premium capacity.
• Row-level security (RLS) on the datasets in the Power BI workspace is enforced for users who only have the Viewer role.
• Users can only export summarized data.
• If you want a user with a Viewer role to Analyze in Excel, they need Build permissions on that dataset.
• Build permission on a dataset also means they can export the underlying data that's used to build the visual, so you might be careful before granting that access, especially with RLS.

There was an improvement to the export of summarized data with the Build permission. If you're using that or are planning to give users the Build permission, please do read the following blog post by Lukasz Pawlowski: Change to Summarized Data Export behavior with Build permission.

Here is an overview of the capabilities of the four roles: admins, members, contributors, and viewers:

So let's take a look at the experience in the Power BI Service. I tested everything myself to be sure, so these are all pictures from our own tenant.

When granting access to a user you can choose from one of the 4 roles:

In the new workspace you can choose to add individual users or add security group, where the latter is the best practice. That way you can manage the users and their access outside of Power BI.

As a Viewer, you only see the Dashboards, Reports and workbooks, in either view of the workspace. So the Datasets and Dataflows are not visible.

This is the File menu when logged in as a Viewer. So you can't download the pbix-file, as that would give you access to the underlying data.

This is the top level content of the workspace when logged in with the Viewer role.

As an Admin in the same workspace, you not only see the Datasets and Dataflows, you also have a lot more options like Usage Metrics, Settings, Delete, etc.

In a next blog post I will show how the Row-Level Security works together with the Viewer role and the Build permission on a dataset.

I hope this makes it a clear overview of the capabilities of the new Viewer role. If you have any other use cases or anything to add please let me know in the comments!