Manage and Secure Power BI
Workspaces, apps and roles
Workspace roles escalate: Admin manages access and the workspace; Member can publish, update app content and add lower-privilege users; Contributor creates and edits content; Viewer only reads. Apps bundle workspace content for consumers, and audiences let you expose different subsets to different groups. Deployment pipelines promote content dev → test → prod and require capacity.
Row-level security
Define roles in Desktop, either static (Country = "UK") or dynamic, filtering a mapping table by USERPRINCIPALNAME() or USERNAME(). Test with View as role. Critical trap: workspace Admin, Member and Contributor can see all data regardless of RLS, so RLS protects consumers, not authors. Publish to web and some export paths ignore or weaken RLS.
Refresh and gateways
An on-premises data gateway lets the service refresh on-premises sources; a personal gateway is single-user and unsuitable for shared datasets. Scheduled refresh allows eight runs per day on Pro and 48 per day on Premium Per User or capacity. Incremental refresh partitions large tables by date range. OneDrive or SharePoint-hosted files refresh roughly hourly without a gateway.
Monitoring and governance
Lineage view shows upstream dependencies; impact analysis shows what breaks if a dataset changes. Endorsement is Promoted (any author) or Certified (authorized reviewers only). Sensitivity labels travel with exported files. Data alerts exist on dashboard tiles, not on report visuals, and subscriptions email report pages on a schedule.
Worked example
A Region managers' table maps email to region. Create a role whose filter on the mapping table is [Email] = USERPRINCIPALNAME(), then validate with View as role. Rule of thumb: put security filters on a dimension, never on the fact.