I have written a dozen of blogs and a book about Power BI row-level security and the security on the dataset. However, I always get this question that: “What if I want some people to see only a few pages of my report, and some others to see other pages?” or “How can I put security for different pages of Power BI report?” In this article, I am going to explain a solution to that.
Row-Level Security is all about the Dataset
Before you ask me about this feature in the row-level security, I have to mention that the row-level security in Power BI is all about the dataset. What does that mean? that means you define the security at the dataset level, not at the visual level. Using the row-level security, you cannot say this role has access to one page, and another role has access to another page or another visual.
So, then how do you implement such a thing? how if in the below example, you want to share the “Rating” page with some users, and the “Sales” page with some others?
let’s assume we have a file called Movies.pbix as below;
I am explaining the solution using copying visuals and shared datasets.
A shared dataset is a Power BI dataset that is used in multiple reports. You can make any datasets a shared dataset. The first step is to publish your original Power BI file to the service;
Now, this dataset, can be used to create any other reports using the Get Data from Power BI datasets:
Then if you select the dataset that we published in the previous step, you will get a live connection to that from Power BI desktop;
now that the row-level security on the dataset cannot resolve this requirement, here is the way to do it: you can separate copies of your visuals into two different Power BI reports. but we don’t do it like a normal copy. every copy would be sourced from the shared dataset. the first step is to create a Power BI file to get data from Power BI dataset as you have seen above.
Then select all visuals in the original Power BI report for one of the pages (let’s say Rating page): Ctrl+A to select all, and then Ctrl+C to copy them.
and then paste it into the file with live connection to the Power BI dataset. because all field names and measures are the same, you should see the results immediately; Ctrl+V to paste
*Remeber that if you have report page filters or page level filters in the original report, then copy and paste won’t bring them here, you need to do that manually.
You can now rename this report to Movies Rating and publish it to a totally different workspace, or even the same workspace with different sharing configurations. Here is an example of published to another workspace:
When you publish the report to a workspace that is not the same workspace as the original dataset, it will create a linked dataset to that;
A linked dataset is just a link to the original dataset, the refresh configuration is set on the original dataset.
You can then do the same thing for any other reports. for example; Movies – Sales is my other report created in the same way and published in another workspace:
and this report is also in its own workspace:
Share with different Audiences
Now because we have two different workspaces, we can easily create two different Power BI Apps to two different audiences, and they will only see their own report:
*Remember that for this method to work, users of this app, need to have read access to the dataset in the other workspace.
And this is the user view of the content: user below only see the sales page
- Because in this method, the security is not implemented on the dataset, the user has access to the data anyways (unless you set up RLS). so if user creates their own report on the dataset, they can build whatever they want.
- The main benefit of this method is the usage of a shared dataset because the normal copy will create a big overhead of maintaining multiple reports and code logic. In this mode, the visualization is separated from the modeling, to read more about this architecture implementation read this article.
- The shared dataset also means that the refresh of data happens once, and all reports are connected to that centralized data.
- The new file copies would be small because they do not contain data, they are just visualizations;
In Summary, row-level security is all about the dataset, not the visuals. If you want to share different visualization pages with different audiences, then creating a copy is the only way at the moment. The method mentioned in this article, however, explains how you can do that with the lowest maintenance cost. using a shared dataset, and multiple workspaces, you can have still one single source of your logic, but visuals shared with two different sets of audiences.