the biggest piece this update missed is the ability to hide individual pages/tabs in a report. it will create a overhead for developer to maintain separate PBIXs
Agreed. If I need to publish different pages (of the same dataset) to different authors I need two pbix files. I guess one pbix file could be live connected to another, but still an overhead...
Appreciate the comment. Unfortunately, today, there is no concept of page level security. It's at the report level. This is a challenge I've heard even beyond just the App. Hopefully we will get that capability in the future.
Also, if a user is part of multiple groups, they have those separate audience views tabbed along the top of the app which is nice. We use this when users have multiple roles (like if a Department Manager was also a Team Leader for example)
Is this in the app when the user opens it up? So they can select if they see it as department manager or team leader by clicking on the tabs you mentioned?
Hi, If users part of multiple group. I can see multiple tabs in app. But the issue is there is a All tab shown in app. Which should not be visible to all audience in multiple group. Please provide solution
I wish there was a capability to rename the app for different audience. It's creating confusion sometimes when one user can see 1 report in the same app but other cannot..
While I see what you have here. We use app owns data mechanism. So our web app controls who can access what reports/dashboards etc. And is really flexible. Also ends up cheaper in licences, so you might want to check that out.
Definitely another approach to take. Although most folks don't have the developer background, and/or the time, to invest in that approach. Also, that's not an intended approach for internal business use.
Did this update remove the ability for users to save copies of reports in their own workspace? Previously they could go to File -> Save a Copy, but now that option doesn’t appear. I have both boxes checked under advanced - allow people to share datasets and allow people to build content. Why would that be removed?
Played around with this last week and noticed that composite models presented a unique problem… needed to provide any user not part of the workspace with build level permissions on the base datasets that fed the composite model. Seems Microsoft may have fixed for PPU accounts but not yet for Pro.
This has always been the case. It's not related to the new app experience. If I understand the scenario correctly, it was done to avoid accidentally oversharing. Instead of assuming you want to provide access to the base dataset, it has to be an explicit action. The owners of the base dataset may have a different owner than the folks creating the composite model. In that scenario, do you want to the owner's or the composite model to be able to alter the access of the base dataset - even when they don't own it? That could get sticky fast.
How can we undo this new app? Or when we create a new app... we have no choice. It should be a preview! We have no fallback. The new app doesn't support hide a report (reports are available, but you have to know a direct link to open it). If we use the new app and "hide" the report - no one is allowed to use this report. It is annoying
Maybe it was something that was fixed, but I'm not able to reproduce what you are describing. From what I showed in the video, I have a report called "AS Trace" that is in one audience. I went the user that didn't have access to that Audience. They were not able to get to the AS Trace report. They also didn't see any reference to it. I have two audiences - "AS Trace" and "AdventureWorks". In the "AdventureWorks" Audience, i'm hiding the AS Trace report. The user that only has access to the "AdventureWorks" audience cannot get to the AS Trace report. Of note, that user is not listed in the access list for the actual Workspace. Only in the App Audience. My main user is an Admin of the workspace and i see an "All" audience and can also see the other audiences, even though I'm not explicitly listed in the audience permission list. Maybe that's what you are seeing?
@@GuyInACube Audience works as designed. My problem is, that we were used to hide reports at the old app experience. So the report was hidden at the navigation bar, but you were able to call the report by a dedicated url. We use this feature for embedded reports (the user should not call the report directly) or for workspaces where we have a lot of reports and we designed a kind of navigation entry-report to call the other (hidden) ones at the same app. But the new audience app has no feature to hide reports. Hiding is there a security feature to deny access. But we don't want deny access, we only want to hide it from the navigation bar.
We’ve been waiting so long and it’s finally here!! A great feature not shown here is the “all” tab which will show all the artifacts a user has permissions to see. Super helpful when they belong to multiple groups. It would be such a headache to remember which group your reports were in. Really thankful they added that in
We need subsections!! Think about creating reports for "Operations". In our world, this includes Supply Chain, Manufacturing, and Quality. Ideally I could have these subsections under Operations....hopefully this ability will be added. Also, we need the ability to change the order of the "audience". Right now, if you try and drag them (which you can do) they do not save the way you arrange them. Seems like you have know in advance what order you want to create the audience in, which is not ideal. They default to the order that they were created in.
Already applied last week in OMV 😎 Saved me a lot of work. Love it. P.S. "Add content" sometimes does not show Report although the Report is not hidden
Glad you are loving it. With that specific issue, what do you mean by "report is not hidden"? With the new app experience, there isn't a way to hide the report from a workspace perspective. You define that within the Audience itself.
@@GuyInACube I added report ("+Add Content") in Content section, hide it for first Audience, I added one more Audience and for them I did not hide it. Report did not show up for all in the App. I repeated same setup in another Workspace, it was working perfectly
It would be even more flexible if you could show/hide pages (tabs) in the reports you include in an app. This will also cover the page level security people are asking for :).
I find it interesting that you can add links to content in other workspaces and thereby share reports already built and published. With this in mind, in principle you can have any number of workspaces with content and have a single workspaces where you create just one app and then use audiences to control accesses in one place
I like the way you think 👊 The experience with just a link could be a bit different from the report being in the actual workspace the App r is for. The other thing to consider is content access. If someone adds a new user or security group to the published App audience, that won't necessarily be available in the other workspace.
@@GuyInACube Yeah, the updating of "source" reports or dashboards in other workspaces needs to be considered in that case. In a sort of governed distributed self-service setup as one might describe our setup, I think it could work if the content providers or publishers also are the ones that are responsible for maintaining the "mother app". Oh and thanks for a great show!
@@GuyInACube And another thing; it seems you cannot create an audience with only links available. It looks like you have to have at least one report or dashboard from the current workspace part of the audiences accesses
Finally! Great job to those PBI guys working on adding all the new features ... PBI really is getting lot better, intuitive and easy to use. I am exploring Tableau now, let's see how it goes.
I am still struggling with this. a) it does only allow whole reports to be viewed or not (I would want that on report/sheet level) and b) it did not even work when I tried it: I made some reports invisible for the "main audience", and they could still be seen by them
Several comments here about page level security. That's just not a concept today within Power BI. Not necessarily specific to Apps. Access is handled at the Report level not at the page level. For the item about still being seen after hiding, did you verify that they didn't have broader access in the Workspace? From what I saw, if I was a member or Admin, I'd still see all content. It was a little confusing, but I think that may be causing it. I tested with a user that wasn't listed in the Workspace, and I saw the right outcome.
Adding to that. In that scenario I had an "All" audience where i saw everything. If i clicked on the different audiences I saw the right view. But because I was in the Admin role of the workspace, I saw all audiences.
@@GuyInACube sounds good, yes indeed I might have tested it with a workspace-member user // edited:: nope, I tested it with a workspace-view User account, not member! my assumption : maybe it only works correctly for newly set-up workspaces/app?
@@GuyInACube But when you can make pages invisible in pbix, why not also in the Service for different user groups? That would be a much needed feature.
Great work around for page level security - does mean though my report in one space has been seperated out to three reports then published back in the same place - great workaround for now :)
Thank you for the explanation. Very clear and crisp. One question, how would the view look like if someone has both Sales and IT accesses..Like Leadership? Thanks
Can the app personas created using the Audience feature be coupled with RLS within the individual reports? How does that work? Let's say within the same group (Audience) I have executives and individual contributors, so I want to layer my report likewise. TIA
Can I disable the email notification which goes out when adding a user to audience or customize it? As that mail would be there first intro to Power BI, it needs to be more than "Hey, an app has been shared with you!"
How does this work with the roles and RLS? Am I having to manage two separate lists now-- who's in which role AND who's in which audience? In theroles dialogue it talks about groups of emails. Where do you set up these groups?
I've got a bug in my implementation that tells the audience that they need perrmissions to view it. Hopefully this bug is resolved ASAP since we can't roll back!
I had a strange error saying that invalid or duplicate emails are not allowed - I needed to type a space or sometimes wait a lot for the Distribution List name to be recognized, but at the beginning it was like a nightmare (I believe you cannot roll back to the old app access experience). Maybe it's just related to my tenant or vpn, but something is happening there, when you grant access.
Many thanks for your video, it helps a lot! May I know if it is possible to auto refresh the app content after I updated and published datasets/dashboards? Currently what I did is after published the updated datasets/dashboards, I manually click update app, then the latest updates show in Apps. Thank you.
Adding multiple user group to different audience is great. But user group is unable to run the report and it shows them specific error "there was error communicating with analysis services. please verify that the datasource is available and your credentials are correct. No OLE dB error information found"
A pity that 'contact info' is the same for all audiences. Reports might be done by different people and therefore contact info should be on audience level as well.
Good point. From a workspace perspective, would it be a common theme? and then could you use a group that contact could go to and people can sort it out from there?
Q: Do you know if there’s an issue with using distribution lists for audiences? I have a distribution list that includes individual users as well as o365 groups within it. It appears like the users in the group within the distribution list don’t actually have access to the dashboard. Are groups within distribution lists too many leves for Power BI to handle?
Interesting. First I've heard of that. Have you opened a support ticket? I know there are fixes and updates coming for various items. Some sooner than others.
Yooo! Yeah it can be hard to go back and change things up. But, for new content created, it may help simplify instead of trying to workaround the limitation presented previously.
This is a good forward step however there are couple of things which we have lost. 1) Control of Visibility which was a good feature to include reports but not display them in the Navigation panel. 2) In the case of paginated reports, when we have got sub reports we definitely don't want sub reports visible in the navigation pane. But when you hide the sub reports the reports don't load at all.. all in all a step backward by the Power BI team...😒😒
Is there anyway to add links to the individual dashboards? I don’t see that option anymore once it was upgraded. I created a landing page so trying to figure out how to share the app report links without having to share the workspace.
If people have viewer roles to the workspace that has 5 total reports and are part of an audience that only has access to one report, does that mean the user will only see the one report in the app but can still see all the reports in the workspace?
Is there a way to restrict access to specific tabs for specific users (without hiding the entire tab)? For example, there may be tabs for sales and others for accounting. Thank you for the excellent videos you create and share!
according to the above comment by Mohit Malhotra, no. "the biggest piece this update missed is the ability to hide individual pages/tabs in a report. it will create a overhead for developer to maintain separate PBIXs".
I know this is an old feature by now but is it possible to setup group security within one "Audience". For example, I have an audience with 3 sections created in it and each section has multiple reports. I need different groups setup with each section. It doesn't appear you can achieve this. Any insights into this or a way for this method to work??
Can a report filter be preconfigured for different users who have the same page on an app? The ideal situation I look to have is giving a similar report but with an preapplied filter for different users eg. By regions
Found an issue with this feature today. Currently trying to figure if it's a bug or a feature, but I'd you use sub-reports in paginated reports, then in he old experience you need to include the reports in the app, but hide them from the user. In the new experience, "hiding" them removes them from the audience completely, making the parent report unusable.
Unfortunately it's a feature (not a bug): Offizial MS Post: ... "By clicking the hide/unhide icon next to each artifact, the App authors can control the access to each artifact within an App." ...
@@johnnywinter861 We are also in the same situation. We have a landing page(another Power BI report) where we enabled links for various reports by hiding them in the Navigation pane. Now in the new app, there is no option to hide from pane by including them in the app.
Ouch. I'll make sure to get that feedback to the team. That's not an ideal scenario for Paginated reports. You wouldn't want people to hit the sub report directly.
Great idea from Microsoft but I don't understand why they choose to have an Update button when I want to see the update data from a report. For instance if my Dataset has a scheduled refresh on a day...the consumers can't see the update data until I MANUALLY press the "Update APP" button....That's not bananas that's ..insane..and it drives me crazy
Has there been a real use case for apps, dashboards or any abstraction from reports that can't just be accomplished by using reports in different workspaces? Been working in Power BI for a while now and never found a need to publish an app or even a dashboard. What am I missing?
@@heniekheniek1781 ahhh I think I get the source of my confusion now. I've always worked at SMBs that don't want to pull the trigger on the premium capacity SKU, so yes - a power BI user of any sort = 1 Power BI pro license ATM. My current company may get there in the next year or so though. Would Apps be the move to distribute content to free users? Can free users not access workspaces directly?
My rule of thumb is if you only have a few people hitting the reports, Apps may not make sense. It may be easier to just give direct access to the workspace. For larger number of users, Apps become easier for broad distribution instead of giving that many people direct access to the workspace. You can then treat the workspace like a development/staging area first and then update the app. In terms of licensing, it depends. Premium Capacity is usually where it helps with broad distribution and not requiring individual licensing. Otherwise, individual licensing, either Pro or PPU, will be required per user. The App can also be used as that abstraction. There may be reports in the workspace that you don't want to expose. The App lets you accomplish that. Or you could just have that content in another workspace.
An app provides a much smoother experience for the user, they can access all their reports in one place and laid out in an inituative way - we only show via apps, never the report directly
Hi, instead of different content for different audience I would like a locked filter specific for each audience but based on the same report. So far not possible or have I missed something ? thanks
There isn't a way too embed the published App. Embedding would be for the specific reports and dashboards. Would love to hear the scenario you are thinking where you would want to embed the whole app as opposed to an individual report.
There is a "reportsection" querystring parameter that can be used to get to a specific page. You would have to do a custom link to use that though within the app.
How did you impersonate the different users e.g. John Doe or Michael? Is there a way to impersonate users for troubleshooting or verification purposes?
In this case, I actually had different users created within my tenant to simulate. You can only do a test with regards to row-level security. No where else without actual users.
HI Adam, it's first step, but honnestly I don't understand why Microsoft don't want to put ACL direclty on Report (.pbix) , each time end users telling me: "why we can't hide certain reports for certain people ? ". Just like ACL on file withjin a folder , it's the BASIC. So with this permission audience, as users have access to the wokspace, they still have access to the different reports ??
In my experience, organizations don't want to do this for specific individuals. They want to manage it for security groups. Either way, you can do this with audiences. But if you are going that granular, you could end up with a bunch of audiences and that causes other problems. I'd start to question the scope and goal of the workspace though and the overall problem you are trying to answer with the report vs the workspace. I'm sure there are valid reasons, but it's a better question over a pint I would think. The general idea is that folks hitting the app wouldn't have direct access to the workspace. Apps are meant for broad distribution without the need to give direct access to the workspace. So, ideally the business user would just have access via an audience of the app. And, not the workspace. From there you can define different access lists for each audience.
@@GuyInACube thank you for your answer. For sure I talked about user but I meant also security group. I didn't notice that user/group that have access to an App via Audience don't need to be part of the underlying workspace. So yes the audience feature fullfill the requirement : we can hide some report based on audience applied to group. 👍
There is not a concept of page level security in Power BI today. I've seen some cool hacks to simulate it, but keep in mind that it's not real security, it's just obfuscation.
Agreed that not having a rollback can be frustrating - especially if you are hitting problems. Maybe support could help? But, that is added friction. I'd like to understand more about what you mean by hidden reports are not accessible to users. What would you expect to have happen?
They see multiple tabs in the top left of the app, one for All (the default when they open the app), followed by separate tabs for each audience. I think it’s a neat solution.
@@benjaminjoseph101 Sorry but I have to say. This I find not so elegant. Imagine the analogy with shared files: Imagine that user would see shared file so many times to a number of how many groups that files is shared and he/she belongs to 😵💫
Yeah I forgot to call that out in the video. If they are a member of different audiences, they will have tabs for the different audiences that they have access to.
I was exited to start using this feature, but then I realized different audience tabs/folders don't provide different URLs. In my org, both audience AA and audience AB have access to report R1. I was hoping to direct audience AA to report R1 via one URL and audience AB to report R1 via their own URL. Turns out, both URLs are the same. Quite honestly, I am dumbfounded that it works this way. I guess I won't be using this feature after all. I know this could be worked around by creating and carefully managing two new user groups, but the admin team at my org is not interested in doing that.
Interesting. I haven't heard that before. If you feel that's the case, you could open a support case. If there are multiple people that have access to update/publish the app, maybe one of them accidently hit the upgrade button without thinking about it. From my perspective, it didn't stand out that much and didn't have a double confirmation either. Once you do it, you can't go back either.
This is so so useful but ruined by the fact it's limited to 10 audiences. I've hit my limit and now have to run separate apps which isn't helpful at all
If the report is hidden within the App/Audience, then from that perspective, it doesn't exist. The one scenario where I understand this is a real problem is for a Paginated subreport. In that case, you never want the subreport to be accessed directly. But for Power BI reports, that's never been an intended scenario. Even for main paginated reports I wouldn't handle it that way. In this context, hidden = does not exist.
The struggle continues to be how to handle workspaces while considering structure of things like an organization. Ultimately at the end of the day I think Microsoft is going to need remember many organizations cannot endorse a citizen developer concept and needs to understand the power bi still has to be managed at a high level.
Hi Adam, It's a great feature. But it is not working as expected. Pls help with the info for my solution. I have four Azure AD groups which are defined at workspace(premium) level. for one of report i implemented Dynamic RLS and assigned the one of Azure AD viewer group as part of RLS. when i implement the above audience feature in my app, for app consumer the option which we implement for audience are also visible Ex - ALL, ABC Report, AB Audience. As expected, it should not show for the app viewer. Pls help info what i am missing.
The lack of foresight in how Power BI Service will be used at scale has continued to be a huge detriment to the product as a whole. From CI/CD, to data security within dashboards/pages, it really feels like Microsoft has provided very shallow solutions to these problems - and this is no different. Charging enterprise pricing for half-baked solutions isn't it.
the biggest piece this update missed is the ability to hide individual pages/tabs in a report. it will create a overhead for developer to maintain separate PBIXs
Agreed. If I need to publish different pages (of the same dataset) to different authors I need two pbix files. I guess one pbix file could be live connected to another, but still an overhead...
Yeah. As with the RLS, They need to create “object level security “
Correct
Appreciate the comment. Unfortunately, today, there is no concept of page level security. It's at the report level. This is a challenge I've heard even beyond just the App. Hopefully we will get that capability in the future.
@bladoblado Object Level Security is at the data model/dataset layer and not the actual pages in the report. those are two different things.
Also, if a user is part of multiple groups, they have those separate audience views tabbed along the top of the app which is nice. We use this when users have multiple roles (like if a Department Manager was also a Team Leader for example)
Yes. I realized i didn't call that out in the video. I wish I had. Appreciate you calling it out here! 👊
Is this in the app when the user opens it up? So they can select if they see it as department manager or team leader by clicking on the tabs you mentioned?
Hi, If users part of multiple group. I can see multiple tabs in app. But the issue is there is a All tab shown in app. Which should not be visible to all audience in multiple group. Please provide solution
I wish there was a capability to rename the app for different audience. It's creating confusion sometimes when one user can see 1 report in the same app but other cannot..
While I see what you have here. We use app owns data mechanism. So our web app controls who can access what reports/dashboards etc. And is really flexible. Also ends up cheaper in licences, so you might want to check that out.
Definitely another approach to take. Although most folks don't have the developer background, and/or the time, to invest in that approach. Also, that's not an intended approach for internal business use.
Did this update remove the ability for users to save copies of reports in their own workspace? Previously they could go to File -> Save a Copy, but now that option doesn’t appear. I have both boxes checked under advanced - allow people to share datasets and allow people to build content. Why would that be removed?
The new experience does not have the "Save a copy" option as part of the Preview. It's planned to be there by GA of the new experience.
Played around with this last week and noticed that composite models presented a unique problem… needed to provide any user not part of the workspace with build level permissions on the base datasets that fed the composite model.
Seems Microsoft may have fixed for PPU accounts but not yet for Pro.
This has always been the case. It's not related to the new app experience.
If I understand the scenario correctly, it was done to avoid accidentally oversharing. Instead of assuming you want to provide access to the base dataset, it has to be an explicit action. The owners of the base dataset may have a different owner than the folks creating the composite model. In that scenario, do you want to the owner's or the composite model to be able to alter the access of the base dataset - even when they don't own it? That could get sticky fast.
Perfect timing, Microsoft! SUUUUPER happy about this!
We are too! 👊
How can we undo this new app? Or when we create a new app... we have no choice. It should be a preview! We have no fallback. The new app doesn't support hide a report (reports are available, but you have to know a direct link to open it). If we use the new app and "hide" the report - no one is allowed to use this report. It is annoying
Agree, please let us decide if we want to go back to the previous app experience
I agree. I don´t like it yet, and would want to switch back.
Maybe it was something that was fixed, but I'm not able to reproduce what you are describing. From what I showed in the video, I have a report called "AS Trace" that is in one audience. I went the user that didn't have access to that Audience. They were not able to get to the AS Trace report. They also didn't see any reference to it.
I have two audiences - "AS Trace" and "AdventureWorks". In the "AdventureWorks" Audience, i'm hiding the AS Trace report. The user that only has access to the "AdventureWorks" audience cannot get to the AS Trace report.
Of note, that user is not listed in the access list for the actual Workspace. Only in the App Audience. My main user is an Admin of the workspace and i see an "All" audience and can also see the other audiences, even though I'm not explicitly listed in the audience permission list. Maybe that's what you are seeing?
@@GuyInACube Audience works as designed. My problem is, that we were used to hide reports at the old app experience. So the report was hidden at the navigation bar, but you were able to call the report by a dedicated url. We use this feature for embedded reports (the user should not call the report directly) or for workspaces where we have a lot of reports and we designed a kind of navigation entry-report to call the other (hidden) ones at the same app. But the new audience app has no feature to hide reports. Hiding is there a security feature to deny access. But we don't want deny access, we only want to hide it from the navigation bar.
Great update on apps! Appreciate it! It would be even better if Audience would link to Perspectives / Object Level Security (including pages).
We’ve been waiting so long and it’s finally here!! A great feature not shown here is the “all” tab which will show all the artifacts a user has permissions to see. Super helpful when they belong to multiple groups. It would be such a headache to remember which group your reports were in. Really thankful they added that in
Agreed 👊
We need subsections!! Think about creating reports for "Operations". In our world, this includes Supply Chain, Manufacturing, and Quality. Ideally I could have these subsections under Operations....hopefully this ability will be added. Also, we need the ability to change the order of the "audience". Right now, if you try and drag them (which you can do) they do not save the way you arrange them. Seems like you have know in advance what order you want to create the audience in, which is not ideal. They default to the order that they were created in.
Incredible functionality! Microsoft getting it right again! Thanks for sharing!!!
Glad you like it! 👊
@@GuyInACube I love it, congrats from Brazil!
Already applied last week in OMV 😎 Saved me a lot of work. Love it.
P.S. "Add content" sometimes does not show Report although the Report is not hidden
Glad you are loving it. With that specific issue, what do you mean by "report is not hidden"? With the new app experience, there isn't a way to hide the report from a workspace perspective. You define that within the Audience itself.
@@GuyInACube I added report ("+Add Content") in Content section, hide it for first Audience, I added one more Audience and for them I did not hide it. Report did not show up for all in the App. I repeated same setup in another Workspace, it was working perfectly
I assume that access is either all or nothing for a report. As an example I can't specify individual pages in the report?
It would be even more flexible if you could show/hide pages (tabs) in the reports you include in an app. This will also cover the page level security people are asking for :).
I didn't understand: do i have to give access to users to workspace and app? Or i can just give access to an app without sharing workspace permission?
I find it interesting that you can add links to content in other workspaces and thereby share reports already built and published. With this in mind, in principle you can have any number of workspaces with content and have a single workspaces where you create just one app and then use audiences to control accesses in one place
I like the way you think 👊 The experience with just a link could be a bit different from the report being in the actual workspace the App r is for. The other thing to consider is content access. If someone adds a new user or security group to the published App audience, that won't necessarily be available in the other workspace.
@@GuyInACube Yeah, the updating of "source" reports or dashboards in other workspaces needs to be considered in that case. In a sort of governed distributed self-service setup as one might describe our setup, I think it could work if the content providers or publishers also are the ones that are responsible for maintaining the "mother app".
Oh and thanks for a great show!
@@GuyInACube And another thing; it seems you cannot create an audience with only links available. It looks like you have to have at least one report or dashboard from the current workspace part of the audiences accesses
Finally! Great job to those PBI guys working on adding all the new features ... PBI really is getting lot better, intuitive and easy to use.
I am exploring Tableau now, let's see how it goes.
I am still struggling with this. a) it does only allow whole reports to be viewed or not (I would want that on report/sheet level) and b) it did not even work when I tried it: I made some reports invisible for the "main audience", and they could still be seen by them
Several comments here about page level security. That's just not a concept today within Power BI. Not necessarily specific to Apps. Access is handled at the Report level not at the page level.
For the item about still being seen after hiding, did you verify that they didn't have broader access in the Workspace? From what I saw, if I was a member or Admin, I'd still see all content. It was a little confusing, but I think that may be causing it. I tested with a user that wasn't listed in the Workspace, and I saw the right outcome.
Adding to that. In that scenario I had an "All" audience where i saw everything. If i clicked on the different audiences I saw the right view. But because I was in the Admin role of the workspace, I saw all audiences.
@@GuyInACube sounds good, yes indeed I might have tested it with a workspace-member user // edited:: nope, I tested it with a workspace-view User account, not member! my assumption : maybe it only works correctly for newly set-up workspaces/app?
@@GuyInACube I deleted all access in the Workspace (also viewers) , and now it seems to work fine. :-)
@@GuyInACube But when you can make pages invisible in pbix, why not also in the Service for different user groups? That would be a much needed feature.
Great work around for page level security - does mean though my report in one space has been seperated out to three reports then published back in the same place - great workaround for now :)
Hi Adam, is it possible to navigate from Apps to desired Workspace reports using a landing page in Apps?
Much needed update! Will smoothen the sharing & accessing process with the wider reach!
YES! 👊
Thank you for the explanation. Very clear and crisp.
One question, how would the view look like if someone has both Sales and IT accesses..Like Leadership?
Thanks
Can the app personas created using the Audience feature be coupled with RLS within the individual reports? How does that work? Let's say within the same group (Audience) I have executives and individual contributors, so I want to layer my report likewise. TIA
Also, I see for Paginated reports, we need to include sub reports but we can't keep them invisible like previous app experience.
Can I disable the email notification which goes out when adding a user to audience or customize it? As that mail would be there first intro to Power BI, it needs to be more than "Hey, an app has been shared with you!"
How does this work with the roles and RLS? Am I having to manage two separate lists now-- who's in which role AND who's in which audience? In theroles dialogue it talks about groups of emails. Where do you set up these groups?
It appears that access granted to the report itself becomes irrelevant and is superseded by the app security?
I work in gov tenant. I dont see this option to create multiple apps per workspace. How do I turne this option on in the admin portal?
I've got a bug in my implementation that tells the audience that they need perrmissions to view it. Hopefully this bug is resolved ASAP since we can't roll back!
Thank you for this clearly presentation, very helpful.
Appreciate the kind words. Thanks for watching! 👊
Can we test an App for different audience groups, i.e. test what excatly they can see?
I had a strange error saying that invalid or duplicate emails are not allowed - I needed to type a space or sometimes wait a lot for the Distribution List name to be recognized, but at the beginning it was like a nightmare (I believe you cannot roll back to the old app access experience). Maybe it's just related to my tenant or vpn, but something is happening there, when you grant access.
Many thanks for your video, it helps a lot!
May I know if it is possible to auto refresh the app content after I updated and published datasets/dashboards? Currently what I did is after published the updated datasets/dashboards, I manually click update app, then the latest updates show in Apps. Thank you.
DUDE!!!! about dang time!! Thanks for posting this, this is a game changer.
It's been a long journey, but it's here!
You can still only have one app per workspace. Howerver If I have a report with multiple sheets, can I assign certain sheets to different users?
Adding multiple user group to different audience is great. But user group is unable to run the report and it shows them specific error "there was error communicating with analysis services. please verify that the datasource is available and your credentials are correct. No OLE dB error information found"
What's the shortcut to select multiple reports to hide? I tried shift or ctrl but it didn't work,
Is there a way to choose whether a user in a security group, once given access to an app via an audience, will be notified of their access via email?
A pity that 'contact info' is the same for all audiences. Reports might be done by different people and therefore contact info should be on audience level as well.
Good point. From a workspace perspective, would it be a common theme? and then could you use a group that contact could go to and people can sort it out from there?
And what’s the net effect of putting a user into the access list of two audiences?
Q: Do you know if there’s an issue with using distribution lists for audiences? I have a distribution list that includes individual users as well as o365 groups within it.
It appears like the users in the group within the distribution list don’t actually have access to the dashboard. Are groups within distribution lists too many leves for Power BI to handle?
Unfortunately this update has various bugs; Since I updated the App, the Power BI Tiles that are embedded in Powerapps are not displayed.
Interesting. First I've heard of that. Have you opened a support ticket? I know there are fixes and updates coming for various items. Some sooner than others.
You can try using F2 shortcut for renaming.
Thanks! I will be trying this out for sure!
Awesome!
Super Useful !! Thanks for sharing.
Thanks for watching 👊
How to create access list??
It's on the Audience configuration. You specify the user or group you want to be part of that audience.
I can't think of any good ideas for consolidating Workspace that I've split up so much ！
Yooo! Yeah it can be hard to go back and change things up. But, for new content created, it may help simplify instead of trying to workaround the limitation presented previously.
This is a good forward step however there are couple of things which we have lost.
1) Control of Visibility which was a good feature to include reports but not display them in the Navigation panel.
2) In the case of paginated reports, when we have got sub reports we definitely don't want sub reports visible in the navigation pane. But when you hide the sub reports the reports don't load at all..
all in all a step backward by the Power BI team...😒😒
Why did you had the help portion?
Is there anyway to add links to the individual dashboards? I don’t see that option anymore once it was upgraded. I created a landing page so trying to figure out how to share the app report links without having to share the workspace.
Do viewers need license too?
If people have viewer roles to the workspace that has 5 total reports and are part of an audience that only has access to one report, does that mean the user will only see the one report in the app but can still see all the reports in the workspace?
Is there a way to restrict access to specific tabs for specific users (without hiding the entire tab)? For example, there may be tabs for sales and others for accounting.
Thank you for the excellent videos you create and share!
according to the above comment by Mohit Malhotra, no. "the biggest piece this update missed is the ability to hide individual pages/tabs in a report. it will create a overhead for developer to maintain separate PBIXs".
I know this is an old feature by now but is it possible to setup group security within one "Audience". For example, I have an audience with 3 sections created in it and each section has multiple reports. I need different groups setup with each section. It doesn't appear you can achieve this. Any insights into this or a way for this method to work??
How can we build a public app with monthly/ yearly subscription.
In one requirement created a Function to fetch refresh token
I have Power bi pro license but unable to see the update option, does this feature available only for premium workspace?
Step in the right direction
with the multiple audiences, is RLS necessary?
Can a report filter be preconfigured for different users who have the same page on an app?
The ideal situation I look to have is giving a similar report but with an preapplied filter for different users eg. By regions
Sounds like you want Row-Level Security. That's the only thing that would provide that per user.
@@GuyInACube interesting! I'll have a look, thanks 👍
This is looong overdue!!!
Agreed! 👊
Does that mean that a workspace can contain only dev team but app can be distributed to people that don't have access to the workspace?
thank you for bringing this announcement to our attention!
Most welcome 👊
It looks good, will ols become part of power bi ? I would like to use it in conjunction with this.
Awesome! Going to try this soon!!
Woot! 👊
Found an issue with this feature today. Currently trying to figure if it's a bug or a feature, but I'd you use sub-reports in paginated reports, then in he old experience you need to include the reports in the app, but hide them from the user. In the new experience, "hiding" them removes them from the audience completely, making the parent report unusable.
Unfortunately it's a feature (not a bug): Offizial MS Post: ... "By clicking the hide/unhide icon next to each artifact, the App authors can control the access to each artifact within an App." ...
@@GhostRider-re5wk that sucks, as it breaks the way it used to work in the old app experience
@@johnnywinter861 We are also in the same situation. We have a landing page(another Power BI report) where we enabled links for various reports by hiding them in the Navigation pane. Now in the new app, there is no option to hide from pane by including them in the app.
Ouch. I'll make sure to get that feedback to the team. That's not an ideal scenario for Paginated reports. You wouldn't want people to hit the sub report directly.
@@GuyInACube exactly! We're raising it with the product team too, but it would be great if someone of your stature could flag it too ;p
Great idea from Microsoft but I don't understand why they choose to have an Update button when I want to see the update data from a report. For instance if my Dataset has a scheduled refresh on a day...the consumers can't see the update data until I MANUALLY press the "Update APP" button....That's not bananas that's ..insane..and it drives me crazy
Has there been a real use case for apps, dashboards or any abstraction from reports that can't just be accomplished by using reports in different workspaces? Been working in Power BI for a while now and never found a need to publish an app or even a dashboard. What am I missing?
It's a sharing mechanism with generally non tech people. They don't need to go into the workspace and choose reports etc
how do yo share reports then? all viewers have pro licence?
@@heniekheniek1781 ahhh I think I get the source of my confusion now. I've always worked at SMBs that don't want to pull the trigger on the premium capacity SKU, so yes - a power BI user of any sort = 1 Power BI pro license ATM. My current company may get there in the next year or so though. Would Apps be the move to distribute content to free users? Can free users not access workspaces directly?
My rule of thumb is if you only have a few people hitting the reports, Apps may not make sense. It may be easier to just give direct access to the workspace. For larger number of users, Apps become easier for broad distribution instead of giving that many people direct access to the workspace. You can then treat the workspace like a development/staging area first and then update the app.
In terms of licensing, it depends. Premium Capacity is usually where it helps with broad distribution and not requiring individual licensing. Otherwise, individual licensing, either Pro or PPU, will be required per user.
The App can also be used as that abstraction. There may be reports in the workspace that you don't want to expose. The App lets you accomplish that. Or you could just have that content in another workspace.
An app provides a much smoother experience for the user, they can access all their reports in one place and laid out in an inituative way - we only show via apps, never the report directly
Hi, instead of different content for different audience I would like a locked filter specific for each audience but based on the same report. So far not possible or have I missed something ? thanks
@Damien would row level security not work for your situation in terms of limiting what data is viewable by different audiences?
For mac?
Can the audience set to see only some pages of the report and not all pages in the report?
It's not that granular. It's for the report as a whole. Not the pages within the report.
Awesome! we can embedded for customers, like reports? The app have some app Id?
There isn't a way too embed the published App. Embedding would be for the specific reports and dashboards. Would love to hear the scenario you are thinking where you would want to embed the whole app as opposed to an individual report.
Love it ❤
Awesome 👊👊
Is there any option to connect these report to one report ( like a hyperlink or a bookmark to one main page)
There is a "reportsection" querystring parameter that can be used to get to a specific page. You would have to do a custom link to use that though within the app.
How did you impersonate the different users e.g. John Doe or Michael? Is there a way to impersonate users for troubleshooting or verification purposes?
In this case, I actually had different users created within my tenant to simulate. You can only do a test with regards to row-level security. No where else without actual users.
As of 9/13/23 you can right click the Audience name to rename!!
GREAT CONTENT - THANKS!
Can you please help me. I am connecting power bi to azure databricks through import option and I facing timeout error how can I resolve it
Do you have answer to it
HI Adam,
it's first step, but honnestly I don't understand why Microsoft don't want to put ACL direclty on Report (.pbix) , each time end users telling me: "why we can't hide certain reports for certain people ? ". Just like ACL on file withjin a folder , it's the BASIC.
So with this permission audience, as users have access to the wokspace, they still have access to the different reports ??
In my experience, organizations don't want to do this for specific individuals. They want to manage it for security groups. Either way, you can do this with audiences. But if you are going that granular, you could end up with a bunch of audiences and that causes other problems. I'd start to question the scope and goal of the workspace though and the overall problem you are trying to answer with the report vs the workspace. I'm sure there are valid reasons, but it's a better question over a pint I would think.
The general idea is that folks hitting the app wouldn't have direct access to the workspace. Apps are meant for broad distribution without the need to give direct access to the workspace. So, ideally the business user would just have access via an audience of the app. And, not the workspace. From there you can define different access lists for each audience.
@@GuyInACube thank you for your answer.
For sure I talked about user but I meant also security group.
I didn't notice that user/group that have access to an App via Audience don't need to be part of the underlying workspace. So yes the audience feature fullfill the requirement : we can hide some report based on audience applied to group. 👍
Hi, I would like to know is there a way to provide access to particular page in a multi page report?
There is not a concept of page level security in Power BI today. I've seen some cool hacks to simulate it, but keep in mind that it's not real security, it's just obfuscation.
Hidden reports are not accessible to users this update doent make sense and also there is no rollback options to old app experience
Agreed that not having a rollback can be frustrating - especially if you are hitting problems. Maybe support could help? But, that is added friction.
I'd like to understand more about what you mean by hidden reports are not accessible to users. What would you expect to have happen?
ain that just the gamecube logo LOL
Finally! Thanks
BAM! 👊
Fantastic!
What if a user is in multiple groups? Do they see the union of the groups vision or does a specific group take precedence?
Yes. And Users that have any type of privilege on Workspace (Viewer, Member etc.) see multiple tabs
They see multiple tabs in the top left of the app, one for All (the default when they open the app), followed by separate tabs for each audience. I think it’s a neat solution.
@@benjaminjoseph101 Sorry but I have to say. This I find not so elegant. Imagine the analogy with shared files: Imagine that user would see shared file so many times to a number of how many groups that files is shared and he/she belongs to 😵💫
Yeah I forgot to call that out in the video. If they are a member of different audiences, they will have tabs for the different audiences that they have access to.
Finally!
I was exited to start using this feature, but then I realized different audience tabs/folders don't provide different URLs. In my org, both audience AA and audience AB have access to report R1. I was hoping to direct audience AA to report R1 via one URL and audience AB to report R1 via their own URL. Turns out, both URLs are the same. Quite honestly, I am dumbfounded that it works this way. I guess I won't be using this feature after all.
I know this could be worked around by creating and carefully managing two new user groups, but the admin team at my org is not interested in doing that.
Well, in the first couple of weeks, there was a bug that you couldn't at new users. MS finally fixed it :)
I know they are paying attention and have different fixes/updates planned. Keep the feedback coming.
BTW, we saw that one of our apps (although we didn't upgrade the app) looks like the new experience. I wonder if that's a bug.
Interesting. I haven't heard that before. If you feel that's the case, you could open a support case. If there are multiple people that have access to update/publish the app, maybe one of them accidently hit the upgrade button without thinking about it. From my perspective, it didn't stand out that much and didn't have a double confirmation either. Once you do it, you can't go back either.
@@GuyInACube Thanks. I checked the activity logs, no such entry. Also, the app still shows the pop-up at top recommending to upgrade the app. Weird.
@@notoriousft I had a similar thing happen with a client's Prod workspace.
This is so so useful but ruined by the fact it's limited to 10 audiences. I've hit my limit and now have to run separate apps which isn't helpful at all
If a user gets link for app report for the hidden report, he/she should be able to see the report I guess. Could you test this and confirm, please
If the report is hidden within the App/Audience, then from that perspective, it doesn't exist. The one scenario where I understand this is a real problem is for a Paginated subreport. In that case, you never want the subreport to be accessed directly. But for Power BI reports, that's never been an intended scenario. Even for main paginated reports I wouldn't handle it that way. In this context, hidden = does not exist.
The struggle continues to be how to handle workspaces while considering structure of things like an organization. Ultimately at the end of the day I think Microsoft is going to need remember many organizations cannot endorse a citizen developer concept and needs to understand the power bi still has to be managed at a high level.
Hi Adam,
It's a great feature. But it is not working as expected. Pls help with the info for my solution.
I have four Azure AD groups which are defined at workspace(premium) level. for one of report i implemented Dynamic RLS and assigned the one of Azure AD viewer group as part of RLS. when i implement the above audience feature in my app, for app consumer the option which we implement for audience are also visible Ex - ALL, ABC Report, AB Audience. As expected, it should not show for the app viewer. Pls help info what i am missing.
That update is awesome! Using insanely! kkkkk
Am I the only person who can create multiple audiences, but then cannot see an eye icon to control what visuals are available to the audience?
The lack of foresight in how Power BI Service will be used at scale has continued to be a huge detriment to the product as a whole. From CI/CD, to data security within dashboards/pages, it really feels like Microsoft has provided very shallow solutions to these problems - and this is no different. Charging enterprise pricing for half-baked solutions isn't it.
Fucking finally!!!! :) It will solve a biiig problem in my company.
The fact i had to find this video to found out how to rename the freaking audience says a lot :/
Large number of users, 10 or more 😂
haha yeah. perspective is everything. Most of the customers we work with have a LOT of users - way beyond 10.
Small / Large number of users is all relative. Many of our reports are shared with 5-10 users but other reports are shared with +200 users