When you build a report, a common requirement is to keep the underlying data up to date. You can refresh a dataset manually in Power BI Desktop or the Power BI service, but this approach isn’t viable when you need to refresh data periodically. To address this issue, you can configure a scheduled refresh in the Power BI service.
You configure a scheduled refresh for each dataset individually in the dataset settings. For this, expand the Scheduled refresh section of the dataset settings and switch the Keep your data up to date toggle to On. You will then be able to configure refresh frequency and other settings, as shown in Figure 4-1.
FIGURE 4-1 Scheduled refresh settings.
You can configure the following settings for scheduled refresh:
Refresh frequency Specify how often the dataset will be refreshed: Daily or Weekly. If you set this option to Weekly, you can select the days of the week the refresh will run.
Time zone The time zone of refreshes.
Time You can add the time of refreshes in 30-minute intervals. The maximum number of refreshes you can set depends on whether the workspace is backed by a Premium capacity.
Send refresh failure notifications to This option can send an email to the dataset owner in case of a refresh failure. You can enter email addresses of other users who will receive the notifications, which can be useful when multiple people are responsible for the dataset.
After you adjust settings, select Apply. If you select Apply without setting the scheduled refresh time, your dataset will refresh at midnight.
You can see refresh history of a dataset at the top of the dataset settings by selecting Refresh history.
You can also make your dataset available for others when you share an app with them. For this, you’ll need to grant the app users the Build permission by selecting the Allow all users to connect to the app’s underlying datasets using the Build permission check box, as shown in Figure 4-5.
FIGURE 4-5 App permissions.
Note Apps
We’re reviewing Power BI apps in more details in Skill 4.2: Create and manage workspaces.
Important Dataset Permissions
Removing app access for a user or a security group doesn’t automatically revoke their access to the underlying datasets. To remove the dataset access completely, you may have to do it by managing permissions of the datasets, as covered next.
Without the Build permission, users won’t be able to connect to your dataset unless they’re contributing workspace members or you give them access to the individual dataset.
Managing dataset permissions
If you want to share an individual dataset, you can do so by managing dataset permissions. To view the permissions of a dataset, select Manage permissions from the dataset menu. You’ll then see a list of users who have access to the dataset, as shown in Figure 4-6.
FIGURE 4-6 Dataset access.
If the dataset resides in a shared workspace, you’ll see the role each workspace member has. Users can have the following permissions:
Read The minimum level of access needed to view reports based on this dataset.
Reshare Allows users to reshare reports and dashboards based on this dataset.
Build With this permission, users can build their own reports from this dataset.
To share a dataset with a new user, follow these steps:
Select Add user.
Enter email addresses or security groups under Grant people access.
Select the permissions you want to grant. You can allow recipients to either reshare the artifact or build new content from the underlying datasets.
Select Grant access.
If you want to change the existing permissions for a user or security group, select Permission options (the ellipsis) next to a user or security group and select the desired action, such as add or remove a permission. Note that workspace roles can’t be changed here.
Note Workspace Roles
We review workspace roles in Skill 4.2: Create and manage workspaces.
For datasets you share, it may be useful to know what other reports or dashboards use this dataset. Since Power BI allows you to use the same dataset across different workspaces, the reports and dashboards that use the dataset may reside outside of its home workspace, and the owner of the dataset may not always have access to the workspace. This information is contained in the dataset’s impact analysis. To see the impact analysis, in the dataset menu select View lineage. You’ll see the information shown in Figure 4-7.
FIGURE 4-7 Impact analysis.
Impact analysis shows the list of reports and dashboards across all workspaces related to the dataset. For each item, you can see how many viewers and views it had in the last 30 days, excluding today, and which workspace it’s in. Impact analysis is particularly useful when you’re making potentially breaking changes to the dataset because you know which items are going to be affected, as well as how popular those items are. You can notify contacts of the affected reports and dashboards by selecting Notify contacts.
Manage global options for files
When using Power BI Desktop, you can change some settings that will apply to your general editing experience when working in Power BI Desktop. To see the settings in Power BI Desktop, select File > Options and settings > Options and note the sections under the Global heading. For example, the Data Load section is shown in Figure 4-8.
FIGURE 4-8 Data Load section of Options.
In addition to global setttings, there are report-specific settings under the Current File heading. Some of the report-specific settings are also available in the Power BI service. To view report settings, open a report and select File > Settings.
Collaboration in Power BI happens in workspaces, which serve as containers for dashboards, reports, workbooks, datasets, and dataflows. In this section we cover how to create and configure a workspace and illustrate how the Power BI service lifecycle strategy can help you implement phased deployments. We also review the skills necessary to create and manage workspaces, assign roles, publish and update apps and workspace assets, and apply sensitivity labels to workspace items.
Each Power BI user has access to their own workspace, called My workspace, and only they can publish to the workspace. Though it’s possible to share content from a personal workspace, the functionality is limited—for example, you cannot create an app in your workspace.
To collaborate with others or package content in an app to share with others, you should create a separate workspace. Doing so will allow others to publish to the same workspace, and you’ll have access to other Power BI features, such as dataflows.
Note Creating Workspaces
A user who wants to create a workspace requires at least a Power BI Pro license.
Figure 4-9 shows a diagram with a simplified relationship between Power BI Desktop reports and Power BI service items.
FIGURE 4-9 Power BI workspace contents.
When you publish a Power BI Desktop to a workspace, you publish the visualizations, which become a report in Power BI service. If there was an associated data model, it would become a Power BI dataset. As discussed in Chapter 3, “Visualize and analyze the data,” dashboards can have visuals pinned from reports and directly from datasets. We review Power BI apps later in this chapter in detail.
To create a workspace in Power BI service, follow this procedure:
From the left-hand menu, select Workspaces > Create a workspace.
Enter the workspace name. The name must be unique in the organization.
Select Save.
When creating a workspace, you can optionally set a workspace image and enter a workspace description. Furthermore, you can use the following advanced settings:
Contact list You can select who will receive notifications about issues in the workspace. By default, it will be workspace admins, or you can enter specific users and groups.
Workspace OneDrive To have the option to add items to the workspace from a dedicated OneDrive location, you can enter it here. Note that there’s no synchronization between the Power BI workspace membership and those who have access to the OneDrive location. You should give access to the workspace to the same Microsoft 365 group that owns the OneDrive location. Managing OneDrive is outside the scope of this book.
License mode If your organization uses Power BI Premium and you’re a capacity admin, you can allocate this workspace to a dedicated capacity. Administration of Power BI Premium is outside the scope of this book.
Develop a template app You can develop a template app and share it with users outside of your organization. Template apps are outside the scope of this book.
Allow contributors to update the app for this workspace By default, contributors cannot update workspace apps; you can change this by selecting this check box.
Once you’ve created a workspace, you can change its settings in Power BI service in the following way:
From the left-hand menu, select Workspaces.
Find the workspace of interest, hover over it, and select More > Workspace settings.
Change the settings as desired.
Select Save.
To delete a workspace, select Delete workspace > Delete from the workspace settings.
You can see the list of users who have access to a workspace by selecting Access from the workspace, where you can also add or remove users. To reflect the different needs of users, Power BI offers four workspace roles:
Viewers can
View dashboards, reports, and workbooks in the workspace.
Read data from dataflows in the workspace.
Contributors can do everything that viewers can do and
Add, edit, and delete content in the workspace.
Schedule refreshes and use the on-premises gateway within the workspace.
Feature dashboards and reports from the workspace.
Members can do everything that contributors can do and
Add other users as members, contributors, or viewers to the workspace.
Publish and update the workspace app.
Share and allow others to reshare items from the workspace.
Feature the workspace app.
Admins can do everything that members can do and
Update and delete the workspace.
Add and remove other users of any role from the workspace.
As mentioned earlier in the chapter, there’s a workspace setting that allows contributors to update apps. This setting can be useful when you want a user to be able to update an app but not add other users to the workspace.
Note that giving someone a role in a workspace does not remove the need to give them additional rights. For example, you may make a user an admin of a workspace, but unless they have a Power BI Pro license, they won’t be able to fully use the role.
Important Row-Level Security
Row-level security applies only to viewers since all other roles have full access to all datasets within a workspace.
Exam Tip
You should know which role is appropriate for a user based on the business requirements. In most cases, you should follow the principle of least privilege.
As you saw with the View as feature in Power BI Desktop, you can test roles in the Power BI service. For this, you need to hover over a role on the Row-Level Security page and select More options (the ellipsis) > Test as role. You will then see the way a report appears to the members of the role. For example, Figure 4-4 shows what members of the Plains role would see, which you created in Chapter 2, “Model the data.” The role applies a filter on Sales Territory.
FIGURE 4-4 Testing a role in the Power BI service.
If needed, you can test a combination of roles or view as a specific user by selecting Now viewing as in the blue bar at the top and selecting the desired parameters. Once you are satisfied with how the roles work, you can select Back to Row-Level Security.
Important Row-Level Security and Workspace Roles
Row-level security does not work on users who have the Contributor, Member, or Admin role in the workspace in which the dataset resides. Those who have edit rights will always see the whole dataset regardless of the security settings, even though the Test as role feature may show a filtered dataset.
We review workspace roles in Skill 4.2: Create and manage workspaces.
Provide access to datasets
The Power BI service enables collaboration between different users. To let other users build reports based on a dataset that you published, you have to share the dataset with them. There are several ways of achieving this, as described next.
Sharing through a workspace
When publishing to the Power BI service, you can publish to your own workspace or a shared workspace. Contributing users of shared workspaces will automatically have access to the dataset you publish.
When you are ready to share your reports and dashboards with users in your organization, you can publish an app. An app is a collection of Power BI items, such as a dashboard, reports, and workbooks, packaged together. There can be only one app per app workspace.
When creating or updating an app, you can select which content items appear in the app by toggling the Include in app switch to Yes or No, as shown in Figure 4-10.
FIGURE 4-10 Include in app switch.
Note that datasets and dataflows cannot be included in the app.
To publish an app from a workspace, select Create app. If an app already exists, you’ll see Update app instead. There are three steps in app configuration:
Setup
Navigation
Permissions
Setup
When you select Create app or Update app, you’ll be taken to app setup, as shown in Figure 4-11.
FIGURE 4-11 App setup.
To publish an app, specify the app name and description. Additionally, you’ll see the following options on the Setup screen:
Support site Share where your users can find help related to the app.
App logo By default, the app logo is the same as the workspace image. You can provide a different one here.
App theme color This color will be used for the app menu and navigation.
Contact information You can select the app publisher, workspace contacts, or specific individuals or groups.
Navigation
In the navigation step, you can customize the navigation pane. In addition to selecting the navigation pane width under the Advanced options, you can rename, reorder, hide, and group app content items under Navigation.
To group app content items, you must create a section first by selecting New > Section and giving it a new name. Then you can select an app content item and select a section from the Section dropdown list.
Furthermore, you can add links to the navigation pane. For each link, you can select where to open it:
On the Permissions screen, you can select who has access to the app. You can grant access to the entire organization or specific individuals or groups. If you only grant access to specific individual or groups, you can select Install this app automatically so that it automatically appears in the Apps section of the Power BI service for each user—otherwise, each user will have to install the app manually from the Apps section.
Note Access for Workspace Users
Users and groups with access to a workspace can access the corresponding app without you explicitly granting them access.
For users with access to the app, you can grant the following rights:
Allow all users to connect to the app’s underlying datasets using the Build permission Although the datasets won’t show up in the app, this setting allows you to connect to datasets from Power BI or use Analyze in Excel.
Allow users to make a copy of the reports in this app This setting allows users to copy reports to their personal workspaces to customize them. It is available only if the Build permission is granted.
Allow users to share the app and the app’s underlying datasets using the Share permission Note that connecting to the datasets requires the Build permission.
Once you publish an app, the result will look like Figure 4-14.
FIGURE 4-14 App view.
Note that the interface only has the app navigation; to go back and see the standard Power BI sidebar, you can select Power BI in the upper-left corner.
Update a published app
After you publish your app, you can make changes to it if you are a contributing workspace user. For this, you need to go to the app workspace and make the changes you want; once you have made the changes, go back to the app workspace list of contents and select Update app. You can also update the Setup, Navigation, and Permissions settings that you configured when you created the app, and then select Update app > Update to propagate the app changes.
Note that on the Permissions screen, you will see the app link, as well as dashboard and report links. When you share any of those links, users will see all contents of the app, not just dashboards or reports.
Unpublish an app
If you want to unpublish an app, you can do so from the app workspace by selecting More options > Unpublish app > Unpublish. Doing so will not delete the app workspace contents; instead, the app will be removed from the list of apps of each user and become inaccessible.
You can publish a report to the Power BI service from Power BI Desktop by selecting Publish on the Home ribbon. To publish a report from Power BI Desktop, you must be signed in. By default, your report will be published to your personal workspace, unless you already published to another workspace in the same session. If you are a contributor in other workspaces, you can select a workspace to publish to.
If the workspace you are publishing to already contains a dataset with the same name, you will be asked if you want to replace it, and you’ll see how many workspace items it affects, as shown in Figure 4-15. This feature can be particularly useful when you’re updating a dataset that has other reports built from it.
FIGURE 4-15 Dataset impact.
An alternative to publishing from Power BI Desktop is to publish from the Power BI service by going to a workspace and selecting New > Upload a file. You’ll be given a choice to publish a local file, a file from OneDrive, or a file from SharePoint, as shown in Figure 4-16.
FIGURE 4-16 Creating new content from files.
Selecting Local File will prompt you to select a file from your computer to publish, whereas OneDrive and SharePoint options allow you to publish from the cloud. Publishing from OneDrive can be beneficial because you can edit a report locally in Power BI Desktop in a folder that’s synced to OneDrive, and it will be published automatically upon saving and closing the file because Power BI can sync published files from OneDrive.
Apply sensitivity labels to workspace content
Within an organization, different data may have different security levels. For example, some data must not leave a specific department, and other data may be shared publicly. To help users understand the sensitivity level of workspace content, you can apply sensitivity labels.
Note Enabling Sensitivity Labels
For users to be able to apply sensitivity labels, they must be enabled in Power BI admin portal tenant settings, typically by the central IT department in the organization. The admin portal is out of the scope of the exam. For more information, see “Enable sensitivity labels in Power BI” at https://docs.microsoft.com/en-us/power-bi/admin/service-security-enable-data-sensitivity-labels.
When information protection is enabled in your Power BI tenant, you can set a sensitivity label for a workspace item in the following way:
Go to the settings of a workspace item.
Select a sensitivity label from the dropdown list under Sensitivity label.
Optionally, check Apply this label to the dataset’s downstream content or similar.
Select Apply or Save.
After you set a sensitivity label, it will be displayed when anyone views the item, as well as in the list of workspace contents, as shown in Figure 4-17.
FIGURE 4-17 Sensitivity labels.
Note how two reports have sensitivity labels shown in the Sensitivity column. If you hover over a sensitivity label, you’ll see its description.
Configuring row-level security (RLS) is a two-step process. In Skill 2.2: Develop a data model, we reviewed the first step—implementing RLS roles in Power BI Desktop. In this section, we review the steps needed to complete the RLS setup for a dataset; we assign and test roles in the Power BI service.
Assigning roles in the Power BI service
Once you’ve configured row-level security roles in Power BI Desktop, you need to publish your report to the Power BI service and add members to each role. To do so, go to the dataset security settings by hovering over a dataset in the list of workspace items and selecting More options > Security. If you don’t have any roles defined in the dataset, you’ll see the message in Figure 4-2.
FIGURE 4-2 The RLS has moved to Power BI Desktop message.
If you’ve created RLS roles defined in the dataset, you’ll see a page like the one shown in Figure 4-3.
FIGURE 4-3 Row-level security role membership.
On the left side of the Row-Level Security page, you can see a list of all roles in the dataset. The numbers in brackets show how many members each role has. On the right, you can view, add, and remove members for a selected role.
To add a member to a role, first select a role on the left, and then enter email addresses or security groups in the People or groups who belong to this role field. After you enter new members, select Add > Save. The changes will be applied immediately.
To remove a member from a role, select the cross next to the member and then select Save.
When you use row-level security in Power BI, you can use an email address for each user. Although this solution works, it can be hard to maintain. For example, consider that you have several datasets that use RLS based on the same rules and it’s viewed mostly by the same users. If a new user joins your company and you need to give them access to those datasets, you will have to update the row-level security settings for each dataset.
In cases like this, you can assign security groups as members of row-level security roles. When a new user joins the company, you will have to add them to the security group only once. The same principles apply to sharing content in Power BI, which we cover later in this chapter.
