Microsoft Power BI • Publishing and Collaboration

Apps for Distribution — Create and manage Apps for distribution (conceptual)

Package Power BI workspaces into curated apps that deliver governed, read-only analytics to large audiences.

Microsoft Power BI emblem with a dashboard, stacked chart, and database.
Inside this lesson 10 sections 5 questions 5 figures

SECTION 1

Historical Context & Motivation

Before cloud-based business intelligence platforms matured, distributing analytical reports to a broad organizational audience was a cumbersome endeavor. Teams relied on static exports—PDF snapshots, emailed spreadsheets, or screen-shared dashboards—each of which severed the connection between the data source and the consumer. Microsoft Power BI evolved through several iterations of its collaboration model to address this fundamental problem: how do you deliver interactive, always-current analytics at scale while maintaining governance and access control?

2015 • Power BI Service Launch

Microsoft launches Power BI as a cloud service. Reports and dashboards live in personal workspaces, but sharing is limited to direct, one-to-one distribution via email links—similar to sharing a Google Doc before shared drives existed.

2017 • App Workspaces Introduced

Microsoft introduces app workspaces (v1), enabling teams to collaborate on content in a shared container and publish curated collections of dashboards, reports, and datasets as organizational apps.

2019 • New Workspace Experience (v2)

The v2 workspace model decouples workspaces from Microsoft 365 groups, introducing granular roles (Admin, Member, Contributor, Viewer) and the ability to distribute apps to security groups, distribution lists, or the entire organization.

2021–2023 • Audience-Based Navigation & Update Permissions

Power BI adds audience-based app navigation, allowing a single app to present different subsets of content to different user groups. App update permissions and install-link sharing further refine the distribution model.

2024+ • Fabric Integration

With Microsoft Fabric, Power BI apps coexist alongside lakehouses, data pipelines, and notebooks in a unified analytics platform, extending the app distribution paradigm to the full data estate.

The central question that drove this evolution is analogous to a core challenge in software engineering: how do you separate the development environment (where dashboards are built and iterated on) from the production environment (where end users consume polished content)? Power BI apps are the answer to that question—a packaging and release mechanism for BI content.

SECTION 2

Core Principles & Definitions

A Power BI app is a read-only, curated collection of dashboards, reports, and optionally datasets that is published from a workspace and distributed to a defined audience. Think of a workspace as a Git repository where developers collaborate, and the app as a tagged release that is deployed to production users. The workspace remains the single source of truth; the app is a versioned snapshot that can be independently updated and re-published without disrupting consumer access until the publisher explicitly pushes changes.

1

Workspace ≠ App

The workspace is the development container where creators build, test, and iterate on content. The app is the published, consumer-facing package derived from that workspace. Changes in the workspace do not propagate to app consumers until the app is explicitly re-published.
2

Read-Only Consumer Experience

App consumers interact with reports and dashboards in a read-only mode. They cannot edit visuals, modify DAX measures, or alter data connections. This enforces data governance by design—analogous to distributing compiled binaries rather than source code.
3

Audience-Based Navigation

A single app can define multiple audiences, each with a tailored navigation pane showing only the reports and dashboards relevant to that group—similar to role-based access control (RBAC) in API design.
4

Automatic Installation & Links

Apps can be configured for automatic installation in users' Apps pane, or distributed via a shareable install link. This removes friction in onboarding new consumers—conceptually similar to silent deployment in MDM.
5

Permissions & Row-Level Security

App access permissions are set at the app level, but data-level restrictions are enforced through Row-Level Security (RLS) defined in the underlying dataset—ensuring that the same report can show different data slices to different users.
✦

KEY TAKEAWAY

Think of a Power BI app like a containerized microservice deployment. The workspace is your Docker build context where you write Dockerfiles (reports), run tests, and iterate. The app is the tagged container image pushed to a registry (the Power BI service), and consumers pull that immutable image to run it. They never see your source code, they can't modify the running container, and you control exactly when a new version is pushed.

SECTION 3

Visual Explanation — The App Distribution Pipeline

WORKSPACE (Dev)📊 Report A📊 Report B📈 Dashboard🗄️ DatasetPublish App ▶publishAPP (Prod)📊 Report A (RO)📈 Dashboard (RO)Audience ConfigFinance → Report ASales → Dashboard🔒 RLS EnforcedinstallCONSUMERS👤Finance👤Sales👤ExecsRO = Read-Only | RLS = Row-Level Security
The left column represents the workspace where content creators build reports, dashboards, and datasets. When the content is ready, the creator publishes an app (center column), configuring audience-based navigation and permissions. Consumers in the right column install the app and see only the content assigned to their audience group, with row-level security enforcing data-level restrictions.

The diagram above illustrates the fundamental three-stage pipeline of Power BI app distribution. Notice the clear separation of concerns: workspace contributors never share the workspace directly with end users, and end users never gain write access to the underlying content. This mirrors the principle of least privilege that computer scientists apply when designing secure systems. The publish action functions as an explicit deployment gate—changes to reports in the workspace remain invisible to consumers until the administrator deliberately re-publishes the app, providing the same deterministic release semantics as a CI/CD pipeline pushing artifacts to a production environment.

SECTION 4

How App Distribution Works — The Mechanics

The Publish Workflow

The process of creating and distributing a Power BI app involves several discrete steps that map closely to a software release lifecycle. First, the content creator ensures the workspace contains all intended artifacts—reports built in Power BI Desktop and published to the service, dashboards pinned from those reports, and the underlying datasets with properly configured refresh schedules. Once content is ready for release, the creator navigates to the workspace settings and selects Create app (or Update app for subsequent releases). This opens a multi-tab configuration pane covering three dimensions: setup, content, and access.

Configuration Dimensions

  1. Setup: Define the app name, description, logo, theme color, and a support contact URL. These metadata fields are analogous to a package.json or a README in an open-source project—they communicate intent and ownership to consumers.
  2. Content (Navigation): Select which dashboards and reports from the workspace should appear in the app. Organize them into sections and, optionally, define multiple audiences that see different subsets. The content tab also supports linking to external URLs, enabling a blended navigation experience.
  3. Access (Permissions): Specify who can install the app—entire organization, specific security groups, distribution lists, or individual users. Optionally allow users to share the app's underlying datasets (Build permission) or restrict access entirely to the curated app experience.

Update Semantics

When a workspace artifact is modified—say, a new visual is added to Report A—the change is not immediately visible to app consumers. The creator must explicitly invoke Update app to push the new version. This two-phase commit model ensures that consumers always see a consistent, tested state of the content. In database terminology, the workspace is the staging area and the app is the committed transaction. Power BI also supports deployment pipelines (Development → Test → Production), which extend this model across multiple workspaces for enterprise-grade release management.

💡

Deployment Pipelines vs. App Publishing

Deployment pipelines and app publishing serve complementary roles. A deployment pipeline moves content between workspaces (dev → test → prod), analogous to promoting code between Git branches. App publishing then distributes the production workspace's content to end users, analogous to deploying the release branch to a CDN. Both mechanisms can be combined for a full CI/CD-style BI workflow.

SECTION 5

Audience Configuration & Permission Model

One of the most powerful features of Power BI apps is audience-based navigation, which allows a single published app to present different views to different user groups without creating separate workspaces or apps. This is conceptually equivalent to a REST API that returns different response payloads based on the authenticated user's role—the underlying resource (the workspace) is shared, but the presentation layer is dynamically scoped.

Audience-Based Navigation ModelPublished App"Sales Analytics App"Audience 1: Sales Reps📊 Pipeline Report📊 Territory Dashboard🔗 CRM Link (External)Audience 2: Managers📊 Pipeline Report📊 Team Performance📈 Revenue ForecastAudience 3: Executives📈 Revenue Forecast📊 KPI SummaryPermission Layer (Applied to All Audiences)🔐 App Access: Security Groups🔒 RLS: Data-Level Filter📋 Build: Optional DatasetAudience navigation controls which content is visible; RLS controls which data rows are returned
This diagram shows how a single published app branches into three audience views. Sales Reps see pipeline and territory content, Managers see team performance and forecasts, and Executives see high-level KPIs and revenue forecasts. The dashed box at the bottom shows the orthogonal permission layer that applies across all audiences.
Permission TypeScopeControls
App AccessEntire appWho can install and view the app. Set via security groups, distribution lists, or 'Entire organization' toggle.
Audience NavigationPer-audience groupWhich reports and dashboards appear in the app's navigation pane for each audience segment.
Row-Level Security (RLS)Dataset / data modelDAX filter expressions on the data model that restrict which rows a given user can see—applied dynamically at query time.
Build PermissionDatasetGrants users the ability to create new reports against the app's datasets in their own personal workspace. An opt-in escalation of access.

Permission types and their scope in Power BI app distribution

SECTION 6

Worked Example — Publishing a Sales Analytics App

Consider a scenario in which a BI team at a mid-size software company needs to distribute sales analytics to three groups: sales representatives, regional managers, and the C-suite. The team has built all content in a workspace called Sales Analytics [Prod]. The workspace contains four reports (Pipeline, Territory, Team Performance, Revenue Forecast), one dashboard (KPI Summary), and a single shared dataset connected to the company's CRM via a gateway.

Publishing the Sales Analytics App

  1. 1

    Step 1 — Verify Workspace Readiness

    Open the workspace Sales Analytics [Prod] in the Power BI service. Confirm that all four reports render correctly with current data by checking the last refresh timestamp of the dataset. Verify that Row-Level Security roles have been configured on the dataset: [Region] = USERPRINCIPALNAME() for territory-level filtering and a broader role for managers. Test RLS by using the 'View as Role' feature in the service.
    All content verified; RLS tested for SalesRep and Manager roles.
  2. 2

    Step 2 — Initiate App Creation

    In the workspace toolbar, select Create app. On the Setup tab, enter the app name ('Sales Analytics'), a description, and upload the company logo. Set the theme color to brand blue and add the support URL pointing to the BI team's Jira Service Desk.
    App metadata configured with name, logo, and support link.
  3. 3

    Step 3 — Configure Audience-Based Navigation

    Switch to the Content tab. Create three audiences: Sales Reps, Managers, and Executives. For the Sales Reps audience, include the Pipeline and Territory reports plus an external link to the CRM. For Managers, include Pipeline, Team Performance, and Revenue Forecast. For Executives, include Revenue Forecast and KPI Summary. Set the landing page for each audience to the most relevant report.
    Three audiences created with tailored navigation: Reps (3 items), Managers (3 items), Execs (2 items).
  4. 4

    Step 4 — Set Access Permissions

    On the Access tab, assign the Azure AD security group SG-Sales-All to the app. Map the Sales Reps audience to SG-Sales-Reps, the Managers audience to SG-Sales-Managers, and the Executives audience to SG-Executives. Enable 'Allow users to install this app automatically' so it appears in users' Apps pane on next login. Leave the Build permission unchecked to prevent consumers from creating derivative reports.
    Access restricted to SG-Sales-All; automatic installation enabled; Build permission denied.
  5. 5

    Step 5 — Publish & Validate

    Click Publish app. Power BI generates an install link that can be shared via email or Teams. Log in as a test user in the SG-Sales-Reps group and verify that only the Pipeline report, Territory Dashboard, and CRM link are visible. Confirm that RLS filters the data to that user's territory. Repeat validation for a Manager test account.
    App live and validated across all three audiences; install link distributed via Microsoft Teams.

SECTION 7

Apps vs. Other Distribution Methods

Power BI offers multiple mechanisms for sharing content—direct sharing, workspace access, embedding, and apps. Each has distinct trade-offs, and understanding when to use an app versus another method is a critical architectural decision for any BI deployment. The table below compares the four primary distribution mechanisms across several dimensions that matter to a computer science professional designing an analytics platform.

DimensionDirect ShareWorkspace AccessAppEmbedded
Consumer ExperienceOne-off link to a single reportFull workspace view (all content visible)Curated, read-only navigationIntegrated in external web app
GovernanceLow—hard to audit at scaleMedium—workspace roles applyHigh—centralized, versionedHigh—token-based auth
ScalabilityPoor for large audiencesModerateExcellent—auto-install to groupsExcellent—API-driven
Edit Access RiskNone (read-only)High—Members/Contributors can editNone (read-only)None (read-only)
License RequiredPro or PPU per userPro or PPU per userPro/PPU (or Free with Premium capacity)Varies—'App owns data' or 'User owns data'
Best ForAd hoc, 1-to-1 sharingTeam collaboration (authors)Broad, governed distributionCustom portals, ISV scenarios

Comparison of Power BI distribution methods

🎯

WHEN TO CHOOSE APPS

Use apps when you need to distribute a coherent collection of reports to a large, heterogeneous audience with zero risk of consumers altering the underlying content. If your scenario resembles publishing a versioned SDK to external developers—where you control the public API surface and consumers can only call, not modify—then apps are the right abstraction. If your scenario instead resembles pair-programming on a shared codebase, workspace access is more appropriate. And if you need to embed analytics inside a custom React application, Power BI Embedded is the tool of choice.

SECTION 8

Connection to Advanced Concepts

Power BI apps are a conceptual gateway to several advanced topics in enterprise BI architecture. Understanding how apps fit into the broader ecosystem prepares you for real-world scenarios where simple app publishing is just the first layer of a sophisticated deployment strategy. The table below maps foundational app concepts to their advanced counterparts.

Foundational Concept (Apps)Advanced CounterpartWhy It Matters
Publish app from a single workspaceDeployment Pipelines (Dev → Test → Prod)Formalizes the promotion process across environments, enabling automated testing and approval gates before content reaches consumers.
Audience-based navigationObject-Level Security (OLS)While audiences control navigation visibility, OLS hides specific tables or columns in the data model itself—useful when even metadata exposure is a compliance risk.
App install linksPower BI REST API for programmatic app managementEnables DevOps teams to script app creation, permission updates, and distribution as part of infrastructure-as-code pipelines using Azure DevOps or GitHub Actions.
Row-Level Security in datasetsDynamic RLS with Azure AD attributesScales RLS beyond hardcoded roles by dynamically filtering data based on directory attributes like department, country, or cost center.
Manual app updateALM Toolkit & CI/CD integrationTools like Tabular Editor and ALM Toolkit enable diff-based model deployments and automated regression testing, treating the BI layer with the same rigor as application code.

Mapping foundational app concepts to advanced enterprise patterns

As Microsoft Fabric matures, Power BI apps will increasingly coexist with other analytical artifacts—notebooks, KQL querysets, and data activator triggers—within unified workspaces. The app distribution model is likely to extend to these artifact types, making the concepts covered in this lesson foundational to a broader class of analytical deployment patterns. For computer science students, the architectural parallels to microservice deployment, feature flagging, and API gateway routing make these concepts immediately transferable to software engineering practice.

SECTION 9

Practice Problems

Question 1: CONCEPTUAL

A colleague suggests sharing the workspace directly with 200 sales representatives instead of publishing an app. Identify at least three risks of this approach and explain how a Power BI app mitigates each one.
Show answer
First, granting workspace access at the Member or Contributor role would allow sales reps to edit or delete reports, creating a significant data governance risk; apps provide a read-only consumer experience that eliminates accidental or intentional modification. Second, workspace access exposes all content in the workspace—including work-in-progress reports and sensitive datasets—whereas an app allows the publisher to curate exactly which artifacts are visible, using audience-based navigation to further segment what each group sees. Third, managing 200 individual user permissions in a workspace is operationally fragile and hard to audit; apps leverage security groups for scalable, centralized access management with automatic installation. Additionally, workspace sharing does not support audience-based navigation, meaning all 200 users would see the same flat list of content regardless of their role.

Question 2: BASIC CALCULATION

An organization has the following groups that need access to a 'Finance Analytics' app: Accountants (45 users), Controllers (12 users), CFO Office (5 users), and Auditors (8 external users). The app is hosted on a Premium Per User (PPU) capacity at $20/user/month. External users (Auditors) require Azure AD B2B guest access. Calculate the total monthly licensing cost, noting that B2B guests with PPU still require a PPU license assigned by the hosting tenant.
Show answer
The total number of users requiring PPU licenses is: 45 (Accountants) + 12 (Controllers) + 5 (CFO Office) + 8 (Auditors as B2B guests) = 70 users. At $20/user/month, the total monthly cost is 70 × $20 = $1,400/month. It is worth noting that if the organization instead used Premium capacity (P1 SKU at approximately $4,995/month), internal users with free Power BI licenses could consume the app without individual PPU licenses, and the break-even point versus PPU would be at $4,995 ÷ $20 ≈ 250 users. Since this organization has only 70 users, PPU is the more cost-effective choice for this scenario. B2B guest users still require explicit license assignment or a Premium capacity to avoid per-user costs.

Question 3: INTERMEDIATE

You are designing an app for a healthcare company. The app must satisfy these requirements: (a) Doctors see only their own patients' data, (b) Department heads see all patients in their department, (c) Hospital administrators see everything, and (d) the compliance team sees aggregate statistics only (no patient-level rows). Describe how you would combine audience-based navigation and Row-Level Security to meet all four requirements within a single app.
Show answer
This scenario requires a layered approach using both audience-based navigation (content visibility) and Row-Level Security (data-level filtering). First, create four audiences in the app: Doctors, Department Heads, Administrators, and Compliance. For content: assign patient-level detail reports to the Doctors, Department Heads, and Administrators audiences, while the Compliance audience receives only aggregate-level reports (dashboards with summarized KPIs, no drill-through to patient rows). For RLS: define three roles in the dataset—'Doctor' with a DAX filter like [AssignedDoctorEmail] = USERPRINCIPALNAME(), 'DeptHead' with [Department] = LOOKUPVALUE(DeptMapping[Department], DeptMapping[Email], USERPRINCIPALNAME()), and 'Admin' with no filter (full access). The Compliance audience does not need an RLS role if they only access pre-aggregated report pages that don't expose the underlying patient table. However, as a defense-in-depth measure, you could create a 'Compliance' RLS role with FALSE() on the patient-level table to ensure no patient rows are ever returned even if a drill-through path is accidentally added later. This combination ensures that navigation controls what reports each group sees, and RLS controls what data rows are returned within those reports.

Question 4: APPLIED

A SaaS company uses Power BI Embedded to provide analytics to its customers. The product team asks whether they should switch from embedded reports to Power BI apps for customer-facing analytics. The company has 300 customers, each with 5–50 users. Evaluate this proposal by comparing the two approaches across scalability, isolation, branding, and cost. Provide a recommendation with justification.
Show answer
Switching to Power BI apps would be inadvisable for this ISV scenario. Scalability: apps require each consumer to have a Power BI Pro, PPU, or Fabric license, which for 300 customers × 5–50 users (potentially 1,500–15,000 users) creates enormous licensing overhead; embedded analytics use an 'App owns data' model where a single service principal authenticates and customers don't need individual Power BI licenses. Isolation: with apps, all customers would potentially see the same app, and multi-tenant data isolation would rely entirely on RLS; embedded analytics offer stronger isolation through per-customer workspaces or programmatic token generation with effective identity scoping. Branding: apps carry the Power BI chrome and require customers to navigate to the Power BI service; embedded analytics render seamlessly within the SaaS product's UI, preserving the company's brand identity and UX consistency. Cost: at $10/user/month (Pro) or $20/user/month (PPU), 5,000 users would cost $50,000–$100,000/month, whereas a dedicated Fabric/Premium capacity for embedding starts at approximately $5,000/month with no per-user cost for consumers. Recommendation: retain Power BI Embedded for customer-facing analytics and reserve apps for internal distribution to the company's own employees, such as product managers or finance teams, where the governance and ease-of-deployment benefits of apps align well with a smaller, known audience.

Question 5: CRITICAL THINKING

Power BI apps enforce a two-phase commit model: workspace changes are invisible to consumers until the app is explicitly re-published. Discuss the trade-offs of this design decision by drawing parallels to version control systems and deployment strategies in software engineering. Under what circumstances could this model introduce risk, and how would you mitigate those risks using Power BI's broader toolset?
Show answer
The two-phase commit model in Power BI apps is analogous to the separation between a Git working tree and a tagged release. The primary advantage is deterministic consumer experience—just as users of a released NPM package are shielded from breaking changes on the main branch, app consumers see a stable, tested snapshot. However, this introduces several risks. First, there is a drift risk: if the workspace evolves significantly between publishes, a large delta in the next update could introduce multiple breaking changes simultaneously, similar to the 'big-bang integration' anti-pattern; this is mitigated by adopting deployment pipelines that enforce regular promotion cadences (e.g., weekly releases from Dev → Test → Prod). Second, there is a stale data risk: while the app content is frozen between publishes, the underlying dataset refreshes on schedule, meaning a report visual might reference a field that was renamed in a newer dataset schema but not yet re-published—this is mitigated by using semantic model versioning and testing refresh + report rendering in a test workspace before promoting. Third, there is a coordination risk: multiple workspace contributors might make conflicting changes without a merge conflict detection mechanism; this is addressed by using Tabular Editor with Git integration (TMDL format) to apply version control directly to the data model. Fourth, there is a rollback gap: Power BI does not natively support rolling back to a previous app version; if a bad publish occurs, the only recourse is to fix forward. Deployment pipelines partially mitigate this by preserving prior-stage content, and organizations can implement backup strategies using the Power BI REST API to export workspace artifacts programmatically before each publish.

SUMMARY

Lesson Summary

Summary

A Power BI app is a curated, read-only package of dashboards, reports, and datasets published from a workspace and distributed to a defined audience. The fundamental architectural principle is the separation of the development environment (workspace) from the production consumer experience (app), enforcing governance through a two-phase commit model where changes propagate only upon explicit re-publication. Audience-based navigation enables a single app to present tailored views to different user groups, while Row-Level Security enforces data-level restrictions orthogonally to content visibility.

Compared to direct sharing or workspace access, apps offer superior scalability and governance for broad distribution, with automatic installation and security-group-based access control reducing operational friction. For computer science students, the conceptual parallels to container image registries, CI/CD pipelines, API versioning, and RBAC make Power BI apps a practical case study in applying software engineering principles to the business intelligence domain. Advanced extensions include deployment pipelines, REST API automation, and Microsoft Fabric integration.

Varsity Tutors • Microsoft Power BI • Apps for Distribution — Create and manage Apps for distribution (conceptual)