Publishing, Sharing, and Collaboration

Introduction

Power BI development does not end when a report is built in Power BI Desktop. A report becomes useful when it is published, governed, refreshed, and delivered to people who can interpret and act on it. Power BI Service provides the cloud environment for publishing semantic models and reports, creating dashboards, distributing apps, collaborating in workspaces, and managing access.

Publishing also introduces responsibilities. A developer must protect confidential information, select appropriate permissions, communicate refresh status, and understand licensing. A technically correct report can still fail if users cannot access it, if its data is outdated, or if unrestricted sharing exposes sensitive information.

This chapter presents the practical foundations of distributing Power BI content in an organizational environment.

Learning Objectives

By the end of this chapter, you should be able to:

• publish a Power BI Desktop file to Power BI Service;
• distinguish workspaces, reports, semantic models, dashboards, and apps;
• assign appropriate workspace roles and sharing permissions;
• distribute content through apps, direct sharing, subscriptions, and exports;
• configure refresh schedules and understand gateway requirements;
• explain the relationship between Power BI licensing and content access;
• apply basic governance, security, and collaboration practices.

1. From Desktop Development to Cloud Distribution

A Power BI Desktop file commonly contains queries, a data model, measures, and report pages. When it is published, Power BI Service creates cloud objects, normally including a semantic model and a report. The semantic model contains data and model logic; the report contains visual layouts that query the semantic model.

A useful publishing sequence is:

1. Validate the model and report in Power BI Desktop.
2. Confirm that sensitive fields, filters, and row-level security are correctly designed.
3. Select the intended workspace.
4. Publish the file and verify the resulting report and semantic model.
5. Configure credentials, refresh, gateway connections, and security.
6. Test access using an appropriate user account.
7. Distribute the content through an app or controlled sharing method.
8. Monitor usage, refresh results, and user feedback.

Publishing is therefore a lifecycle rather than a single button click.

2. Essential Power BI Service Objects

Workspaces

A workspace is a collaborative container for reports, semantic models, dashboards, dataflows, and related content. It is usually aligned with a team, department, project, or business process. A workspace is not merely a folder: it also defines collaboration permissions and, in many cases, the licensing and capacity context in which content operates.

Reports

A report is a collection of interactive pages containing visuals, filters, slicers, drillthrough paths, bookmarks, and navigation. Reports are generally connected to one or more semantic models. Report consumers can interact with visuals without necessarily having permission to edit the underlying design.

Semantic models

A semantic model, formerly commonly called a dataset, stores data structures, relationships, calculated measures, hierarchies, and security rules. It may use Import, DirectQuery, or a composite storage design. Refresh applies primarily to imported data; DirectQuery commonly obtains data from the source at query time, although performance and source availability remain important.

Dashboards

A dashboard is a single-page canvas in Power BI Service composed of pinned tiles. Tiles may originate from reports, semantic models, or other content. Dashboards are useful for executive monitoring because they provide a consolidated view, but they are not a replacement for a detailed report. A dashboard tile can link users back to the report page from which it was pinned.

Apps

A Power BI app is a packaged, consumer-oriented distribution of selected workspace content. App creators can include reports, dashboards, and navigation elements while controlling what the audience sees. An app creates a clearer separation between development and consumption than simply giving every user workspace access.

3. Workspace Collaboration and Roles

Power BI workspaces provide role-based access. The principal roles are:

Exact capabilities can vary with tenant settings, content type, and licensing. The principle remains important: grant the least privilege necessary.

Workspace access should normally be assigned to security groups rather than maintained through many individual accounts. Group-based access makes staff changes easier to audit and reduces the probability that a former employee retains access.

A workspace should have a clear purpose, owner, naming convention, and lifecycle policy. Development and production content should not be mixed casually. Many organizations use separate development, test, and production workspaces, with controlled promotion between them.

4. Sharing Methods and Their Uses

Direct sharing

A report or dashboard can be shared directly with selected users or groups. Direct sharing is convenient for small, targeted audiences, but it can become difficult to govern when many links and permissions accumulate. A shared link must not be treated as a security boundary by itself; access is still determined by identity and permissions.

Workspace access

Giving a person Viewer access to a workspace allows consumption of workspace content. Giving Contributor, Member, or Admin access grants increasingly powerful authoring or management capabilities. Workspace access is appropriate for collaborators, not for every executive or occasional consumer.

Apps

Apps are generally preferable for stable, curated distribution. The workspace remains the authoring area, while the app becomes the consumer-facing product. An app can be updated when a report changes, and audiences can be managed separately from the development team.

Subscriptions

A subscription sends users scheduled email notifications containing a snapshot or link to a report, dashboard, or page, subject to tenant and licensing conditions. Subscriptions improve awareness but do not replace access control. Recipients must be authorized to view the underlying content, and email distribution must comply with information-security policy.

Exporting

Users may be able to export summarized or underlying data, export a report to formats such as PDF or PowerPoint, or analyze data in Excel. Export permissions are controlled by tenant, workspace, semantic-model, and report settings. Exporting creates a copy outside the governed interactive environment, so it may create additional confidentiality and version-control risks.

The choice of method should reflect the business need:

5. Licensing and Capacity Constraints

Licensing is a design constraint, not an administrative detail. Power BI access commonly involves individual licenses such as Free, Pro, or Premium Per User (PPU), and organizational capacity such as Power BI Premium capacity or Microsoft Fabric capacity. Names, feature availability, and commercial terms can change; administrators should verify current Microsoft licensing documentation and the organization’s agreement.

As a practical foundation:

• Publishing and collaboration in shared workspaces generally require a suitable paid license, commonly Pro or PPU.
• Users consuming content in shared capacity generally require an appropriate paid license.
• Content hosted in qualifying dedicated capacity may be consumable by users with free licenses, subject to capacity type, tenant configuration, and feature restrictions.
• PPU content normally requires PPU licenses for users who need access to its advanced features.
• A license does not automatically grant access to a report; permissions and security still apply.

Licensing should be checked at three levels: the author’s ability to publish, the workspace or capacity where content is hosted, and the consumer’s ability to view or interact with it. Organizations should also consider refresh limits, model size, deployment features, and export restrictions when selecting capacity.

A sound access review asks:

1. Who authors the content?
2. Where is the content hosted?
3. Who consumes it?
4. Is the workspace in shared or dedicated capacity?
5. Does the content use PPU-only features?
6. Are guest, external, or mobile users subject to additional controls?

6. Refresh, Credentials, and Gateways

Refresh concepts

An imported semantic model contains a stored copy of data. A scheduled refresh updates that copy from its sources. Refresh frequency and maximum schedules depend on licensing, capacity, connector, and tenant conditions. A refresh schedule is not a guarantee that data will always be current: credentials may expire, source systems may be unavailable, queries may fail, or gateway machines may be offline.

A refresh operation should be monitored through refresh history and failure notifications. A report should communicate the currency of its data, especially when decisions depend on daily or hourly information.

Credentials

Power BI Service must be able to authenticate to each data source. Credentials should be owned by an appropriate organizational identity or managed service account rather than by an employee’s personal account where policy permits. Permissions should be limited to the required source objects.

On-premises data gateway

An on-premises data gateway provides a secure bridge between Power BI Service and supported data sources located inside a private network. The gateway does not simply “upload the database”; it relays approved queries or refresh operations between the service and the source.

A gateway deployment requires attention to:

• installation on a reliable, supported machine;
• network connectivity and firewall rules;
• data-source definitions and matching connection details;
• credential management;
• high availability where business impact justifies it;
• monitoring, patching, and ownership.

Cloud sources may not require an on-premises gateway, although they still require valid connections and credentials. DirectQuery models may depend on gateway availability whenever the source is on-premises.

7. Security and Governance

Row-level security

Row-level security (RLS) restricts the rows returned to a user according to defined roles. For example, a regional manager may see only records associated with that manager’s region. RLS must be tested as the actual consumer or through the service’s role-testing features. Giving a user workspace Admin, Member, or Contributor rights can allow them to bypass the intended consumer experience, so authors and consumers should be separated carefully.

Sensitivity and information protection

Reports may contain personal data, financial information, employee records, or commercially sensitive measures. Labels, access policies, tenant settings, and controlled export should be used where available. A report title or color scheme is not a security control.

Governance practices

Effective governance includes:

• a named business owner and technical owner;
• documented refresh frequency and data sources;
• a data dictionary for important measures;
• agreed workspace and report naming conventions;
• review of permissions and external sharing;
• retention and archival rules;
• change control for production content;
• monitoring of refresh failures and usage.

Power BI activity logs and usage metrics can support oversight, but monitoring should follow privacy, employment, and regulatory requirements.

8. A Practical Publication Workflow

Consider an analyst who has completed a sales performance report in Power BI Desktop.

Preparation. The analyst checks that revenue measures use the correct date table, removes unused columns, verifies slicers, and documents the meaning of “net sales.” The model is tested with representative users.

Publication. The analyst publishes to the Sales Development workspace rather than directly to a production audience. The service creates the report and semantic model.

Configuration. The analyst maps the semantic model to its gateway data source, enters organizational credentials, and schedules a refresh after the source system’s nightly load. The analyst checks refresh history after the first run.

Security. Regional managers are placed in a security group. RLS maps each group to permitted regions. The analyst tests a manager account and confirms that unauthorized regions are absent.

Promotion. After business acceptance, the content is moved or redeployed to a production workspace. A curated app is published with an executive dashboard and detailed report pages. Consumers receive app access rather than contributor permissions.

Operations. A subscription is created for the sales director, refresh failures are monitored, and a quarterly access review is scheduled. The report includes a visible “data refreshed” indicator and a link to definitions.

This workflow illustrates that successful distribution combines technical configuration, security, communication, and ongoing ownership.

9. Illustrative Case: Northwind Community Health Network

Background

Northwind Community Health Network operates clinics in three regions. Its management team wants a monthly dashboard showing appointments, cancellations, waiting time, and revenue. Patient-level details are confidential, while aggregated measures may be shared with regional managers.

Problem

The first version was emailed as a spreadsheet. It became outdated quickly, contained more personal detail than necessary, and gave no reliable indication of which figures had been refreshed.

Analysis

The team identified three audiences: executives, regional managers, and analysts. Executives needed summarized trends; regional managers needed only their own region; analysts needed development access. The source database was on premises, and the organization had a gateway already used for other governed reports.

Approach

The team created separate development and production workspaces. Analysts received Contributor access in development. Regional managers received app access and were mapped through security groups to RLS roles. The executive dashboard used aggregated measures and excluded patient identifiers. A gateway connection was configured using a managed organizational credential. Refresh was scheduled after the clinical system’s nightly update, and the report displayed the latest successful refresh time.

The production app included a dashboard, a management report, definitions, and a support contact. Export of underlying data was restricted because detailed exports were not necessary for the business purpose.

Outcome

Executives received a consistent monthly view, regional managers could compare authorized performance, and analysts retained a controlled place to improve the model. The network reduced spreadsheet duplication and could investigate refresh failures through service history.

Learning points

The case demonstrates four principles: distribute according to audience; separate authoring from consumption; apply security before publication; and treat refresh, ownership, and support as part of the product.

10. Common Failure Modes and Best Practices

Failure: publishing into a personal workspace

Personal workspaces are unsuitable for important organizational products because ownership, continuity, and governance are weak. Use an appropriately governed team workspace.

Failure: giving consumers editing rights

Excessive permissions increase the risk of accidental changes and security exposure. Use an app or Viewer access for consumers.

Failure: assuming publication equals refresh

Publishing uploads the current state of the file; it does not guarantee future updates. Configure and test credentials, gateways, and schedules.

Failure: ignoring licensing until launch

A report may work for its author but fail for intended consumers. Confirm license and capacity assumptions during design.

Failure: distributing exports without controls

PDFs, spreadsheets, and email attachments can persist after permissions are changed. Minimize exports, restrict sensitive data, and label approved outputs.

Failure: treating RLS as a substitute for all security

RLS controls model rows for appropriate consumers. It does not replace workspace permissions, source-system security, information protection, or careful administration.

Recommended operating checklist

Before release, confirm that:

• the workspace has an owner and a defined purpose;
• report and semantic-model names are understandable;
• refresh credentials and gateway connections work;
• refresh history has been reviewed;
• RLS has been tested with representative users;
• audience permissions follow least privilege;
• licensing and capacity have been confirmed;
• sensitive exports and external sharing are controlled;
• the app navigation and support instructions are clear;
• a maintenance and review date has been assigned.

Contemporary Developments

Power BI is increasingly used within broader Microsoft Fabric environments, with centralized governance, deployment pipelines, lineage, endorsement, and integration with collaboration tools. These developments strengthen the need for lifecycle management: content should be promoted, documented, monitored, and eventually retired.

AI-assisted features may help users summarize reports, generate questions, or identify patterns, but AI output must not be treated as automatically correct. Organizations should validate generated explanations, protect confidential prompts and data, and preserve human accountability for decisions. AI assistance improves accessibility and productivity; it does not remove the need for semantic-model quality, security, or professional judgment.

Chapter Summary

Publishing in Power BI Service transforms a Desktop solution into a managed organizational product. Workspaces support collaboration, while reports, semantic models, dashboards, and apps serve different purposes. Direct sharing is useful for small audiences, whereas apps provide a curated consumer experience. Subscriptions and exports extend distribution but introduce access, privacy, and version-control considerations.

Workspace roles should follow least privilege, and development should be separated from production where practical. Licensing depends on the author, hosting capacity, and consumer context; permissions remain necessary even when a user has a license. Imported models require planned refresh, valid credentials, and sometimes an on-premises gateway. Security requires appropriate workspace permissions, row-level security, information protection, and governance. Reliable Power BI delivery is therefore a continuing operational process involving ownership, monitoring, documentation, and review.

Key Terms

Workspace: A governed collaborative container for Power BI content.

Semantic model: Data, relationships, measures, and security logic used by reports.

Report: Interactive pages containing visuals and analytical navigation.

Dashboard: A single-page collection of pinned tiles in Power BI Service.

App: A curated package of workspace content distributed to consumers.

Workspace Admin: A role with broad workspace management authority.

Contributor: A role intended for creating or updating workspace content.

Viewer: A role primarily intended for consuming content.

Direct sharing: Granting selected users or groups access to content.

Subscription: A scheduled email delivery or notification for Power BI content.

Export: Producing a copy of data or a report in another format.

Refresh: Updating stored imported data from its source.

Gateway: A bridge between Power BI Service and supported private-network sources.

Credential: Authentication information used to connect to a data source.

Row-level security: Rules that restrict data rows according to user identity or role.

Capacity: Computational and storage resources assigned to Power BI content.

Least privilege: Providing only the access required for a task.

Governance: Policies and controls for secure, reliable, compliant content management.

Review Questions

Short Answer Questions

1. What is the difference between a Power BI report and a dashboard?
2. Why are apps often preferable to broad workspace access for consumers?
3. What is the purpose of an on-premises data gateway?
4. Name two factors that influence whether a user can access Power BI content.
5. Why should refresh history be monitored?

Long Answer Questions

1. Explain the roles of workspaces, semantic models, reports, dashboards, and apps in a complete publication lifecycle.
2. Discuss how licensing and capacity affect authors, consumers, and distribution choices.
3. Describe a secure workflow for publishing a report that uses an on-premises database.
4. Explain how workspace roles, row-level security, and information protection work together.
5. Compare direct sharing, apps, subscriptions, and exports, including the advantages and risks of each.

Analytical / Application Questions

1. A regional report contains confidential customer data. Analysts need to edit it, managers need regional access, and executives need aggregated results. Design a workspace, security, and distribution arrangement and justify your choices.
2. A report’s scheduled refresh fails after an employee leaves the organization. Diagnose the likely governance problem and propose a resilient solution.
3. An organization wants to distribute a report to 500 occasional users but has limited paid licenses. Identify the licensing and capacity questions that must be answered before selecting a distribution method.

Multiple Choice Questions with Answers

Question 1

Which Power BI object is primarily intended to package curated content for consumers?

A. Dashboard

B. App

C. Gateway

D. Workspace role

Correct Answer: B. App

Question 2

What is the main purpose of an on-premises data gateway?

A. To design report visuals

B. To replace semantic models

C. To connect Power BI Service securely with supported private-network data sources

D. To assign workspace roles

Correct Answer: C. To connect Power BI Service securely with supported private-network data sources

Question 3

Which principle recommends giving users only the access required for their work?

A. Least privilege

B. Maximum sharing

C. Open publication

D. Capacity scaling

Correct Answer: A. Least privilege

Question 4

What does a scheduled refresh primarily do for an imported semantic model?

A. Changes report colors

B. Updates stored data from its sources

C. Creates a new workspace

D. Removes row-level security

Correct Answer: B. Updates stored data from its sources

Question 5

Which role is generally most appropriate for a user who only needs to consume workspace content?

A. Admin

B. Member

C. Contributor

D. Viewer

Correct Answer: D. Viewer

Question 6

Why should development and production workspaces be separated when practical?

A. To prevent all users from viewing reports

B. To support controlled testing and release

C. To eliminate the need for licenses

D. To make gateways unnecessary

Correct Answer: B. To support controlled testing and release

Question 7

What does row-level security control?

A. The physical location of a gateway

B. Which rows a user can see in a semantic model

C. The number of report pages

D. The visual theme of a dashboard

Correct Answer: B. Which rows a user can see in a semantic model

Question 8

Which distribution method is most suitable for a periodic email notification while retaining access controls on the underlying report?

A. Subscription

B. Gateway

C. Workspace deletion

D. Model compression

Correct Answer: A. Subscription

Question 9

Why can exporting data create governance risk?

A. Exports always disable refresh

B. Exports create copies outside the interactive governed environment

C. Exports automatically grant Admin rights

D. Exports prevent users from opening reports

Correct Answer: B. Exports create copies outside the interactive governed environment

Question 10

Which statement about licensing is most accurate?

A. Having a license automatically grants access to every report

B. Only report authors need licensing consideration

C. Access depends on licensing, hosting capacity, permissions, and sometimes feature restrictions

D. Licensing has no relationship to workspace collaboration

Correct Answer: C. Access depends on licensing, hosting capacity, permissions, and sometimes feature restrictions