To enforce detailed workspace security in Power BI, workspace roles, app permissions, and Microsoft 365 security groups must be strategically handled. Within the Power BI workspace, user access is dictated by roles, which include Admin, Member, Contributor, and Viewer roles, each with its own set of capabilities. These roles, however, only apply at the workspace level and not at the individual report level. Therefore, to restrict access to particular reports, those reports need to be published in a separate app.
The suggested method is to have a single workspace for development and to distribute tailored content through Power BI Apps. Access permissions on apps can then be assigned using Microsoft 365 security groups, ensuring each group will only see what they're authorized to. Thus, this method maintains a centralized data model whilst controlling who sees what across different app versions or sections.
For more complex scenarios, combine this with Row-Level Security (RLS) and shared datasets. Keep your data models in one workspace, publish them as certified datasets, and report layers are built in separate workspaces. Such a modular architecture, in conjunction with clear governance policies, would be strongly enforceable in terms of access to data and visibility of reports without unnecessary duplication of content.
