Skip to content
Power BI Metrics Book
Not released yet: nothing on these pages installs until 0.1, the first release. Run it on the sample tenant today.

Who gets in

This step decides who may use the book and what they see. Everyone in your tenant can get in with one role, or nobody until they are given one. Power BI still decides which datasets each person’s queries can read.

Before you start

Section titled “Before you start”
  • You are the admin (you confirmed yourself in The app registration).
  • The email addresses of the curators who will review metrics, and any other admin.

The three roles

Section titled “The three roles”
Role Can
viewer Read, search, query, ask and comment.
curator Everything a viewer can, and change the book, verify as agent, accept and archive threads.
admin Everything a curator can, and settings, secrets, conventions, people, service accounts, sync and audit.

Steps

Section titled “Steps”

  1. On step 6, Who gets in, under People, domains and groups use the form to give roles. Choose Who, choose the Role, fill in the box that appears and press Give the role:

    • A person: their email, as they sign in. Matches only a verified email.
    • An email domain: the domain after the @, such as example.com. It counts for people who sign in with Microsoft, an OpenID Connect provider that verifies the email, or a Google Workspace account of that domain.
    • A Microsoft group: the group’s Object ID in Entra. In the Microsoft Entra admin center browse to Entra ID > Groups > All groups, select the group, choose Properties and copy Object ID. Nested groups count. Groups are read from the person’s own Power BI connection when they connect and again each day they are active.
    • Everyone in the tenant: the people of your Power BI tenant.

    Source for the Object ID: Microsoft, Manage Microsoft Entra groups and group membership, under Edit group settings.

    Press Remove beside a line to take a role away. The last admin cannot be removed.

  2. Under Everyone in the tenant gets, choose Viewer (the default), Curator, or No role until given one. The last lets in only the people, domains and groups you assigned. Admin is not on the list on purpose.

  3. Under Who sees a dataset’s description, choose one of the three ways metadata is shown (below).

  4. Press Check who gets in.

A person that no role reaches sees “Nobody has given you access to this Power BI Metrics Book yet. Ask one of its admins to add you.” and cannot sign in.

Who sees a dataset’s description

Section titled “Who sees a dataset’s description”
Choice in the setup Setting value A person may see a dataset when Fits
Those Power BI lets read the dataset powerbi Power BI lets them reach it: through a workspace they are in, an app whose audience they are in, or a direct share. Groups count. A company that wants the book to show each person what Power BI shows them.
Everyone who gets in everyone They are signed in. A small company, or a book everyone may read.
Whoever the access policy says policy Your own Cerbos policy says so, by workspace, app, endorsement, sensitivity label or a custom field. A company with its own rules. See Roles and policies.

Companies share Power BI in two ways, and most use both. Workspaces give people a role in the workspace. Apps give people a place in an app’s audience. powerbi follows both: the sync reads each workspace’s access list and each app’s audience, so people who reach a dataset only through an app see it too. These lists are as fresh as the last sync (an hour by default). A company that decides by something else than Power BI access chooses policy.

Running DAX for people

Section titled “Running DAX for people”

A person can only run queries through the book when Power BI allows it. Two things must be true. Both are Power BI’s rules, and Power BI checks them at the moment of every query.

  1. The tenant setting Semantic Model Execute Queries REST API is on. It is on by default, under Integration settings in the tenant settings. Check it if queries fail for everyone. (Older pages call it Dataset Execute Queries REST API.)
  2. The person has Read and Build permission on the semantic model. They have it when they:
    • hold at least the Contributor role in the model’s workspace, which gives Build on every model in it; or
    • were given Build on the model by its owner, on the model’s Manage permissions page; or
    • are in the audience of an app published with Allow users to build content with the semantic models in this app ticked (under Advanced in Manage audience access). That applies to models in the app’s own workspace. For models in another workspace, grant Build on the model itself.

For a company that shares through apps: Build is granted when the app is published to its audience. Removing someone from the audience does not take it back. To take it back, remove their Build permission on the model itself, from the model’s Manage permissions page.

Source: Microsoft, Datasets - Execute Queries, Build permission for shared semantic models (How users get Build permission) and Create and distribute workspace apps (Create and manage multiple audiences).

Check

Section titled “Check”

Press Check who gets in. It cannot fail. It passes with a sentence such as “Everyone in the tenant gets in as viewer, and the people, domains and groups assigned a role get it.” and shows who would get in, as a list. Read the list. You can run the same from a terminal:

Terminal window
pbmb admin check who_gets_in
pbmb admin roles list
pbmb admin roles assign curator --person ada@example.com

Next: Search.