Govern Power BI Workspaces and guest access

Get a list of your Power BI workspaces, and find the ones without an administrator, with external users, or that nobody uses.

Before you begin

• Your Rencore role needs the permissions to create reports and policies. See Rencore roles.
• Power BI is connected. It needs an Entra ID app that you create in your tenant. See Power BI Consent.
• Power BI is part of the Apps, Automation & BI module. See Add-ons.

Steps

See your workspaces

1. Go to Reports > Add Report.
2. Filter the “Report Template Library” by the service Power BI and choose a template:
   • “Workspace Distribution Dashboard”: all workspaces by type
   • “High-Traffic Workspace Analysis”: the workspaces with the most activity
   • “Resource Utilization Analysis”: unused content by type
3. Save the report. See Create a Report from a Template.
4. To see who has access to a workspace, open the Power BI object “Workspace” in the inventory. Users and groups appear as related objects per role: admins, members, contributors and viewers. See the Power BI inventory reference.

Flag the workspaces that need attention

1. Go to Policies > Policy Options ([…]) > Create Policy.
2. Choose the templates that match your rules:
   • Ownership: Power BI Workspaces without Administrators
   • External access: Power BI Workspaces with External Access, External Sharing Risk with External Users, Power BI Dashboards with External Access
   • Activity: Inactive Power BI Workspaces, Inactive Power BI Reports, Empty Workspace Cleanup Alert, Orphaned Power BI Datasets
   • Labels: Power BI Reports without Classification
3. Check the logic, set the severity, and save. See Create a Policy from a Template.

Follow up

Rencore Governance finds the workspaces. The change itself is made in Power BI. Create a Custom Automation with the trigger “on policy violation” and the action “Send email” to tell the workspace administrators or your Power BI team about each new violation.

What you see

Each policy lists the workspaces, reports or datasets that match. After the change in Power BI, the item leaves the policy on the next Power BI scan.

Limits

• Rencore Governance has no actions that change Power BI workspaces, and no review of Power BI workspace access.
• The workspace inventory has no owner column. Administrators show as related users and groups.
• Finding users who were given access directly, outside a role group, needs one policy per workspace.