The document outlines best practices and recommendations for Power BI governance, focusing on access management within workspaces. It details the roles of admins, members, contributors, and viewers, including their capabilities and recommended usage scenarios. Additionally, it provides insights into sharing reports and data management techniques to ensure effective collaboration and security in Power BI environments.

1. Power BI Governance
Access Management, Recommendations and Best Practices
By: Isha Kapoor (former MVP) learningsharepoint.com

2. 1
POWER BI GOVERNANCE | Access Management, Recommendations and Best Practices
LEARNINGSHAREPOINT.COM
Contents
Power BI Workspace........................................................................................................................2
Workspace Access Management...........................................................................................2
Roles in the Workspaces.......................................................................................................2
Sharing a Workspace as Contributor...............................................................................5
Sharing a Workspace as Viewers.......................................................................................5
Contributors, Viewers and Build access..........................................................................6
Contributors, Viewers, and Reshare access...................................................................7
Report Access Management.........................................................................................................7
Sharing a Report as Read.....................................................................................................7
Reports Embedded in SharePoint..............................................................................................9

3. 2
POWER BI GOVERNANCE | Access Management, Recommendations and Best Practices
LEARNINGSHAREPOINT.COM
Power BI Workspace
Workspaces are places to collaborate with your colleagues on a collection of dashboards, reports, and
paginated reports.
Workspace Access Management
Workspaces allow you to create collections of dashboards, reports, and paginated reports that you
can also bundle into an app and distribute it to your whole organization, or to specific people or
groups.
In a Workspaces, you can:
 Assign workspace roles to user groups: security groups, distribution lists, Office 365 groups, and
individuals.
 Create a workspace in Power BI without creating an Office 365 group.
 Use granular workspace roles (admins, members, contributors, and viewers) for more flexible
permissions management in a workspace.
Roles in the Workspaces
To grant access to a new workspace, add user groups or individuals with one of the workspace roles:
viewers, members, contributors, or admins. Everyone in a user group gets the role you’ve defined.
Below are the capabilities of the four roles: admins, members, contributors, and viewers. All of these
capabilities, except viewing and interacting, require a Power BI Pro license.
Reference from Microsoft here.
Capability Admin Member Contributor Viewer
Update and delete the workspace. X
Add/remove people, including other admins. X
Add members or others with lower permissions. X X
Publish and update an app. X X
Share an item or share an app.1 X X
Allow others to reshare items.1 X X
Create, edit, and delete content in the workspace. X X X
Publish reports to the workspace, delete content. X X X
Create a report in another workspace based on a dataset in
this workspace.
X X X
Copy a report. X X X
View and interact with an item. X X X X
1. Contributors and Viewers can share items in a workspace if they have Reshare permissions.

4. 3
POWER BI GOVERNANCE | Access Management, Recommendations and Best Practices
LEARNINGSHAREPOINT.COM
Note
Sharing feature is only available to users with a Power BI Pro license. Your recipients also need
Power BI Pro licenses, unless the content is in a Premium capacity.
Creatingand Sharinga Workspace
Creating a workspace through Power BI service lets you provision a workspace that is not connected
to an Office 365 group. In Power BI service, select Create a workspace to begin creating a new
workspace.
In your new workspace, select Access from the top navigation and then add users with one of the
three roles.

5. 4
POWER BI GOVERNANCE | Access Management, Recommendations and Best Practices
LEARNINGSHAREPOINT.COM

6. 5
POWER BI GOVERNANCE | Access Management, Recommendations and Best Practices
LEARNINGSHAREPOINT.COM
Sharinga Workspace as Member
Members of a workspace are Owners of Reports and Datasets and can create, edit, and delete
content in the workspace. Members can also take Over the dataset, create and distribute reports in
another workspace based on a dataset in this workspace, Publish and update report or an app, share
a report or an app, and Add members or others with lower permissions to the workspace or reports.
Recommendation
Adding user as a Member to a workspace is NOT recommended for business users who can interact
with the reports from within SharePoint Online or Power BI service. They can be added as Viewers
to the workspace or Read or Read & Reshare directly to the reports.
Sharinga Workspace as Contributor
Contributor role provides limited access when it comes to removing workspace admins but allows
enough access to Create, edit, and delete content in the workspace and delete a dataset or edit the
data structure. Refer to the above chart for features that are different from those of Members.
Recommendation
Adding user as a Contributor to a workspace is NOT recommended for Business users who can
interact with the reports from within SharePoint Online. They can be added as Viewers to the
workspace or Read or Read & Reshare directly to the reports.
Sharinga Workspace as Viewers
Viewer role provides read-only access to workspace resources but can be combined with roles like
reshare and build to enhance business users’ capabilities. When the workspace is in a Power BI
Premium capacity, users with the Viewer role can access the workspace even if they don't have a
Power BI Pro license. Refer to the above chart for features that are included in the viewers role.
Recommendation
To allow users with Viewer role to export data, ensure they have Build permission on the datasets in
the workspace. See next section for details.

7. 6
POWER BI GOVERNANCE | Access Management, Recommendations and Best Practices
LEARNINGSHAREPOINT.COM
Contributors, Viewers and Buildaccess
People with Admin, Member or Contributor role in a workspace also gets assigned with Build
permissions to datasets that belong to that workspace. For viewers, Build permission role can be
added.
Build permission applies to datasets. When your users have Build permissions, they can build new
content on your dataset, such as reports, dashboards, pinned tiles from Q&A, and Insights Discovery.
You can remove Build permissions. If you do, the people whose permissions you have revoked can
still see the report, but can no longer edit the report or export underlying data. Users with only read
permission can still export summarized data.
Recommendation
If you do not wish to give your users access to an underlying dataset or access to create or modify
reports based on your dataset, you can opt to either add users as Viewers to the workspace or
provide users with individual access to reports by sharing each report as Read or Read & reshare.
To add or remove Build permissions for a Viewers role, navigate to Manage Permissions of your
Dataset and then using the eclipse menu of your targeted user, select Add build.

8. 7
POWER BI GOVERNANCE | Access Management, Recommendations and Best Practices
LEARNINGSHAREPOINT.COM
Contributors, Viewers, and Reshare access
Contributor and Viewers roles in a workspace can be combined with reshare role for sharing reports
and datasets. Otherwise, sharing an individual report (not through workspace access) also provides
you with an option to add users as Read + Reshare.
If you are using Contributor or Viewers role through Workspace access, go the to the Sharing or
Access tab for reports or Dataset, and select Add reshare from the eclipse menu of the entitled user.
You can also removereshareor add build permissionsfor thedataset to a viewers roleanytime.
Recommendation
Adding build access to users with Viewers role is NOT recommended. If you want to share reports or
dashboards with your users providing them limited access such as Read, opt to share these
resources individually with no build permissions. See the section below.
Report Access Management
Once a developer develops a report, they can distribute it to licensed users with Read or Read &
Reshare access via Power BI service dashboard.
This is generally done when a user does not have access through the parent Workspace and does not
require access to any other resources such as dashboards or datasets that belong to that workspace.
The access will be targeted to a specific report or a dashboard just like item-level permission is
granted in SharePoint.
Sharinga Report as Read
Users can be assigned Read or Read & reshare access so they can consume and distribute(share)
read-only reports.

9. 8
POWER BI GOVERNANCE | Access Management, Recommendations and Best Practices
LEARNINGSHAREPOINT.COM
To do this, in your Workspace, for the Report to Share (under the Reports tab), select Share.
Enter the email of the userwhoyouwant to share the report with. Make sure to uncheck with “Allow
users to build new content using the underlying datasets” as keeping this option selected will
provide build access to the business users for the underlying dataset.
See the figure below.
Once added,go to Manage Permissionsandverify.Addreshare permissionif needed.

10. 9
POWER BI GOVERNANCE | Access Management, Recommendations and Best Practices
LEARNINGSHAREPOINT.COM
Reports Embedded in SharePoint
If the Power BI reports are embedded in SharePoint, businessusers need to have Power BI pro license and
access to the SharePoint site to viewthe reports.
Resharing of reports can only be done through Power BI service. Make sure your businessuserssite
owners have training around how to reshare the reports to other business users from Power BI service.