Support

Submit a ticket My Tickets Login
Welcome
Login

tyGraph RLS Report Management for Power BI Apps

Overview

One of the great advantages of reports presented in tyGraph Online is the ability to automatically show users a subset of data. For example show a Yammer Admin only data for groups that they administrate. We do this using a pre-defined role with Row Level Security (RLS). Organizations that cannot access tyGraph Online can take advantage of Power BI Apps to create the same effect. This app will be created on your tenant and requires additional management which we will outline below.


TABLE OF CONTENTS


Also feel free to refer to the Microsoft Documentation which you can find here: https://docs.microsoft.com/en-us/power-bi/service-create-distribute-apps#licenses-for-apps


Requirements

To create and manage a Power BI App you will need the following:

  • At least one user with a Pro License (for publishing the app) Note: A premium capacity will be required if your consumers have Power BI free. See this Microsoft Article for details.
  • RLS Compatible tyGraph .pbix file


Licenses for apps

Back to Top

To create or update an app, you need a Power BI Pro license. For app consumers, there are two options.

  • Option 1 The workspace for this app is not in a Power BI Premium capacity: All business users need Power BI Pro licenses to view your app.
  • Option 2 The workspace for this app is in a Power BI Premium capacity: Business users without Power BI Pro licenses in your organization can view app content. However, they can't copy the reports, or create reports based on the underlying datasets. Read What is Power BI Premium? for details.

https://docs.microsoft.com/en-us/power-bi/service-create-distribute-apps#licenses-for-apps


Initial Setup

Back to Top

Creating this Power BI App will include 3 major steps:

  1. Create workspace to fit your licensing situation
    • Create a Premium workspace (if the app will be viewed by Power BI free users)
    • OR Create a regular workspace (all app users will need a Power BI Pro license)
  2. Load RLS PBIX File
  3. Publish Organizational App

Provisioning a Premium Capacity Workspace

If your organization does not have a premium capacity, you will need to provision one in your Azure tenant. For a detailed guide on creating thig please see this Microsoft page.

https://docs.microsoft.com/en-us/power-bi/developer/azure-pbie-create-capacity

For related guide on purchasing Power BI Premium see:

https://docs.microsoft.com/en-us/power-bi/service-admin-premium-purchase

  1. Once you have your premium capacity provisioned, open your Workspace tile in Power BI.
  2. Create a new workspace
  3. Name the new workspace
  4. Set the workspace to Private
    • If you set the workspace to public than any users with a Pro license will be able to view the report loaded into this group regardless of any security roles that you have employed.
  5. Set the workspace so that members can only view the Power BI content
  6. Add any other admins that will be managing the workspace. It should be noted as in step 4 that any users added to the workspace will be exempt from RLS roles.
  7. Enable dedicated capacity
  8. Select the dedicated capacity workspace of your choice
  9. Save your changes

File Load

Back to Top

  1. Our team will provide a file for installation. Usually we’ll share this in your Yammer private group. 
  2. Select your premium capacity workspace created in the previous section in the workspaces drop-down 
  3. Select the get data option at the bottom of the while still in the premium workspace 
  4. Select the “get” option in the files section 
  5. Select local file 
  6. Select the designated file and click open 


 

 

Creating Your App

Back to Top

Below is a summary of installing an app to get you running quickly. For a detailed explanation please see the Microsoft documentation here: https://docs.microsoft.com/en-us/power-bi/service-create-distribute-apps

  1. Select the premium workspace
  2. Open the report pane
  3. Enable the uploaded report in the “Included in App” toggle. By default all of your reports will be included in your app. This is why it is good to keep the report for the app in their own workspace for simplicity.
  4. Click “Publish App” 
  5. In the Details pane enter a description for the app, add background. 
  6. Open the content tab and select “specific content” for the app landing page. You can make the landing page either a report or dashboard. For ease of use we recommend that you have the app landing page set to the report. 
  7. Select the Access tab, check the box to “install the app automatically” for users who have been given permission
  1. In the permissions section, be sure to only allow permission to “Specific individuals or group”
  2. You can verify the dashboards reports, workbooks, and datasets that will be included in the app by viewing the totals next to each icon
  3. Once finished press finish


Maintaining Access

Back to Top

Part of maintaining a Power BI app requires that a user or team or application manages users. This is done by adding and removing users (or a distribution group*) to both the role and permissions. If you are adding Group Admins for example you must add them to the security role first and then add the user in the app permissions section.

*You can use distribution groups to control both security groups and RLS role access.
https://docs.microsoft.com/en-us/power-bi/admin/service-admin-rls#add-members


Adding a User

Back to Top

  1. Scroll down the premium workspace to the datasets section
  2. Open the dataset options panel by clicking the ellipsis next to the dataset
  3. Select the “Security” option
     
  4. Select the security role. There will almost always just be one role shown here
  5. Enter the email address of the new user
  6. Click Add
  7. Save your changes
     
  8. Navigate back to the workspace.
     
  9. Select update app.
     
  10. Go to the permissions section
  11. Add your users to the app.
  12. A popular option is ensure “Install App Automatically” is enabled. If it is greyed out then this option has been disabled by your Power BI administrator.
  13. Click update app.

 

 

 

 

Removing a User

Back to Top

  1. Go to your workspace.

 

  1. Select “Update App”

 

  1. Navigate to the permissions header.
  2. Remove users.
  3. Select Update app.


End User Experience

Back to Top

If you enabled automatic install in the app creation than users will be able to see the application by simply opening the “Apps” pane in Power BI. (Creating your app. #7, Adding Users)

If read only has been enabled for the user, they will be able to view the report and use all items in the filters pane. The user will not be able to edit the report layout or save any filter changes.