Leverage Audiences for Flexible Report Sharing within Power BI Apps

A Little Background on Workspaces and Apps

When a report creator is ready to publish a report to the Service, they need to select a corresponding Workspace where the report will be housed. It’s best practice to create workspaces by subject matter, or data domain. For instance, setting up a Workspace named “Human Resources” would allow report creators to add content pertaining to the org structure, headcount, salary information, etc.

That’s the easy part. The more difficult part is when it comes down to sharing the report with end users. Microsoft has created multiple ways to share reports, each with their own set of limitations:

• Sharing a single report with a set of users (Good)
  • While this works on an ad hoc basis, it’s unsustainable to manage a different set of permissions for each report in your organization
• Granting access to a Workspace for users to view multiple reports within a data domain (Better)
  • This is a more efficient way to share, but could allow users to make edits to reports if given the incorrect permission to the Workspace
• Creating an App as an extension of a Workspace and assign permissions to just the App (Best)
  • This gives a clear delineation of read access (App) and write access (Workspace)

The only wrinkle with using the best practice of creating an App is that the Workspace to App relationship is one-to-one. Prior to 2023, this could potentially become an issue if you wanted different levels of permissions within the same App.

Let’s use the HR Workspace/App example from above. Let’s say you’ve created three HR-related reports: Salary (for executives), Headcount (for HR Dept), and Org Chart (everyone). Each of these reports has different data sensitivity and intended audiences. Because you could only apply one set of permissions to an App, the process was to create multiple Workspaces/Apps for each audience. So instead of having one HR App, you would end up with HR Executive, HR Dept, and HR All.

Starting in 2023, Microsoft introduced a new feature called Audiences. This presented the ability to assign multiple sets of permissions to one singular App, eliminating the need to create multiple Workspaces/Apps for the same data domain with varying sets of permissions.

How is it set up?

When creating an App from a modern workspace, it will have three sections to complete: Setup, Content, Audience. The Setup section contains basic information about the App, such as the name and description. The Content section allows you to choose which reports from the Workspace are ready to be viewed by end users in the App. Note that not all reports contained in a Workspace need to be included in an App.

Last is the Audience section. It’s as simple as selecting which reports can be viewed in each audience and attaching a set of users to that audience. Note: when adding permissions, it’s best practice to attach security groups as opposed to individually named users.

Using the HR example from earlier, here is how one App can have levels of permissions with different reports viewable for each group:

• HR – All
  Access to the Org Chart
• HR – Dept
  Access to the Org Chart + Headcount
• HR – Exec
  Access to the Org Chart + Headcount + Salary Data

Limit your Apps, Maximize your Audiences

Audiences are a way for Power BI admins to keep a limited number of Workspaces/Apps, while adding multiple layers of permissions to the same reports. Organizing reports using this structure will avoid the need to create multiple versions of the same Workspace and will streamline report access provisioning.