Skip to content

Security Matrix

See in one grid which users, groups and apps have which access to the selected Power BI items, including access they get through Microsoft Entra groups.

How it works

Explore Security opens a closable tab with the selected items as rows and every principal that has access to any of them as a column. Each cell shows the principal's access right on that item, as Power BI reports it, for example Admin, Member, Contributor, Viewer for workspaces or ReadReshare for an item shared directly.

The matrix is built from collected data on the MetaMiner Server (MMS). It covers workspaces, reports, dashboards, semantic models and dataflows.

Access How it is shown
Direct Granted to the user, group or app itself
Inherited Granted to a group the user belongs to, nested groups included. Shown only when Show inherited access is on; hover over the cell to see Inherited via and the group name

Inherited access needs Microsoft Graph group membership data, which MetaMiner collects when the environment's app has the Graph permissions. Without it, the filter pane shows the note Graph API pull must be enabled to show inherited access. See API Permissions.

Before you begin

  • Your MetaMiner role grants View Security in the environment. See Permissions Reference.
  • The number of items you can open at once is limited by Max Security Rows: in Preferences (default 1000).

Steps

  1. In the Power BI Explorer, select one or more items, for example a workspace.
  2. Right-click and choose Explore Security > Selection Only for just those items, or Selection and Children to include everything under them. A new tab opens. Its tooltip names the items it covers, and the toolbar shows Updated at: with the time the data was loaded.
  3. Read the grid: rows are items, columns are principals by display name. Hover over a column header to see the e-mail address and the principal type in brackets, for example [User] or [Group].
  4. To include access through groups, open the Inherited Access filter and tick Show inherited access.
  5. To narrow the rows, use Item Types in the filter pane or the quick search box.

Image of the security matrix for a workspace with children: items as rows, users and groups as columns, access rights in the cells and Show inherited access ticked

../../images/client/pbi-security-matrix.png

Filters

Section Effect
Item Types Show only the chosen kinds: Report, Dashboard, Dataset, Datasource, Dataflow
Inherited Access Show inherited access adds access that comes from group membership

Export

Use the export drop-down on the toolbar to save the grid to CSV or Excel for an access review. See Toolbar and Export.

Examples

Question Do this
Who can see anything in this workspace? Workspace > Selection and Children, Show inherited access on
Which reports are shared directly with people instead of through the workspace? Workspace > Selection and Children, Item Types: Report, look for user columns with report-level rights
Is a departed employee still listed? Open the matrix and look for their name in the column headers