TECH **Power BI Workspaces & Apps: Zero-Fluff, Hands-On Guide**

Power BI Workspaces & Apps: Zero-Fluff, Hands-On Guide

(Classic vs. Modern App Workspaces, Apps, and Production Realities)

1. What This Is & Why It Matters

You’re a Power BI engineer at a mid-sized company. Your team just inherited a mess: - 20+ "Classic" workspaces with no clear ownership, some abandoned, others with broken permissions.
- Reports deployed as "My Workspace" (yes, that workspace) because "it was faster." - Stakeholders complain that they can’t find the latest version of a report, or worse—they’re editing the wrong one.
- Security audits flag that external contractors have access to internal data because someone shared a workspace link instead of an app.

This guide fixes that.

Why Workspaces & Apps Matter in Production

• Workspaces = Your development environment. Think of them like Git branches—isolated spaces where teams build, test, and collaborate.
• Apps = Your production deployment. Like a Docker container, an app is a read-only, version-controlled snapshot of your workspace that you publish to end users.
• Classic vs. Modern Workspaces = The difference between a shared folder (Classic) and a proper DevOps pipeline (Modern). Modern workspaces integrate with Azure AD, capacity-based licensing, and proper governance.

If you ignore this:
❌ Reports get overwritten by accident.
❌ External users see internal data.
❌ Your Power BI Premium capacity gets wasted on abandoned workspaces.
❌ You fail compliance audits (GDPR, HIPAA, etc.).

If you master this:
✅ One source of truth – No more "which version is the right one?" ✅ Proper access control – External contractors see only what they’re supposed to.
✅ Cost savings – No more paying for Premium capacity on unused workspaces.
✅ Audit-ready governance – Every change is tracked, every user is accounted for.

2. Core Concepts & Components

? Workspace

• Definition: A container for Power BI content (reports, dashboards, datasets, dataflows).
• Production Insight: Never use "My Workspace" for team projects—it’s like committing to main instead of a feature branch.

? Classic Workspace

• Definition: Legacy workspace type (pre-2019) that uses Office 365 Groups for permissions.
• Production Insight: ⚠️ No Azure AD integration—permissions are managed via O365, which is a nightmare for large orgs. Migrate to Modern ASAP.

? Modern App Workspace

• Definition: Current workspace type (post-2019) that uses Azure AD security groups and supports Premium capacity.
• Production Insight: Required for Power BI Premium—if you’re paying for Premium, you must use Modern workspaces.

? App

• Definition: A read-only, versioned "package" of a workspace that you publish to end users.
• Production Insight: Always deploy via Apps—never share workspace links. Apps are like a "release build" of your workspace.

? Workspace Roles

• Production Insight: Never give "Viewer" access in a workspace—use Apps instead. Workspace Viewers can still see all content, including drafts.

? Capacity (Premium vs. Shared)

• Definition:
• Shared Capacity = Free/Power BI Pro (limited resources, no dedicated performance).
• Premium Capacity = Dedicated resources (faster refreshes, larger datasets, paginated reports).
• Production Insight: Modern workspaces are required for Premium. If you’re paying for Premium, migrate Classic workspaces now.

? Deployment Pipelines

• Definition: A DevOps-like workflow for Power BI (Dev → Test → Prod).
• Production Insight: Only available in Modern workspaces. If you’re not using this, you’re doing Power BI wrong.

3. Step-by-Step: Migrate from Classic to Modern Workspace

Prerequisites

✅ Power BI Admin rights (or at least workspace Admin).
✅ Azure AD security groups (for permissions).
✅ Power BI Premium capacity (if using Premium).

Step 1: Audit Your Classic Workspaces

# PowerShell: List all Classic workspaces (requires Power BI Admin API)
Connect-PowerBIServiceAccount
Get-PowerBIWorkspace -Scope Organization -Filter "type eq 'Workspace'" | Where-Object { $_.IsOnDedicatedCapacity -eq $false } | Select-Object Name, Id, Type

Expected Output:

Name               Id                                   Type
----               --                                   ----
Sales Reports      1234abcd-5678-90ef-ghij-klmnopqrstuv Workspace
HR Analytics       9876zyxw-5432-10uv-wxyz-abcdefghijkl Workspace

Why? You need to know what you’re migrating before you start.

Step 2: Create a Modern Workspace

1. Power BI Service → Workspaces → Create workspace.
2. Name: Sales Reports (Modern)
3. Description: Migrated from Classic - Do not edit directly
4. License mode: Premium per capacity (if using Premium).
5. Advanced → Workspace OneDrive: None (unless you need it).
6. Create.

⚠️ Trap: If you select Pro instead of Premium, you cannot use Premium features later.

Step 3: Migrate Content from Classic to Modern

Option A: Manual Export/Import (Small Workspaces)

1. Open Classic workspace → Datasets → Settings → Export .pbix (for each dataset).
2. Open Modern workspace → New → Dataset → Import .pbix.
3. Repeat for Reports and Dashboards.

⚠️ Trap: Dataflows cannot be exported this way—you’ll need to recreate them.

Option B: Power BI REST API (Large Workspaces)

# PowerShell: Clone a workspace (requires Admin API)
$classicWorkspaceId = "1234abcd-5678-90ef-ghij-klmnopqrstuv"
$modernWorkspaceId = "9876zyxw-5432-10uv-wxyz-abcdefghijkl"

# Get all reports in Classic workspace
$reports = Get-PowerBIReport -WorkspaceId $classicWorkspaceId

# Clone each report to Modern workspace
foreach ($report in $reports) {
    Export-PowerBIReport -WorkspaceId $classicWorkspaceId -Id $report.Id -OutFile "C:\temp\$($report.Name).pbix"
    New-PowerBIReport -WorkspaceId $modernWorkspaceId -Path "C:\temp\$($report.Name).pbix" -ConflictAction CreateOrOverwrite
}

Why? Faster for large workspaces, but does not copy dataflows or dashboards.

Step 4: Set Up Permissions (Azure AD Groups)

1. Azure Portal → Azure Active Directory → Groups → New Group.
2. Group name: Power BI - Sales Reports - Viewers
3. Membership type: Assigned
4. Members: Add users who need read-only access.
5. Power BI Service → Modern workspace → Access → Add people or groups.
6. Role: Viewer
7. Group: Power BI - Sales Reports - Viewers

⚠️ Trap: Never assign individual users—always use Azure AD groups for scalability.

Step 5: Publish an App

1. Modern workspace → Create app.
2. Setup:
3. Name: Sales Reports (Prod)
4. Description: Official production version - Last updated: $(Get-Date -Format "yyyy-MM-dd")
5. Theme: Apply your company branding.
6. Navigation:
7. Hide drafts (so users don’t see WIP reports).
8. Reorder reports (put the most important one first).
9. Permissions:
10. Specific users/groups: Power BI - Sales Reports - Viewers
11. Install app automatically: Yes (if you want to push to users).
12. Publish app.

⚠️ Trap: Never publish an app with "Entire organization" unless it’s truly public.

Step 6: Verify & Clean Up

1. Test the app:
2. Log in as a Viewer (not Admin) and confirm you can’t edit anything.
3. Check that draft reports are hidden.
4. Archive the Classic workspace:
5. Power BI Service → Classic workspace → Settings → Delete workspace.
6. ⚠️ Trap: Do not delete until you’ve verified the Modern workspace works!

4. ? Production-Ready Best Practices

? Security

• Never share workspace links—always use Apps.
• Use Azure AD groups (not individual users) for permissions.
• Enable "Block classic workspace creation" in Power BI Admin Portal to enforce Modern workspaces.
• Audit logs: Enable Power BI audit logs in Microsoft 365 Compliance Center.

? Cost Optimization

• Delete unused workspaces (check Power BI Admin Portal → Workspaces).
• Use Premium capacity only for high-traffic workspaces (not all of them).
• Set up auto-scaling for Premium capacities to avoid over-provisioning.

? Reliability & Maintainability

• Naming convention:
• Workspaces: [Team] [Purpose] (Dev/Test/Prod) (e.g., Sales Reports (Prod)).
• Apps: [Team] [Purpose] (v1.2) (e.g., Sales Reports (v2.1)).
• Use Deployment Pipelines (Dev → Test → Prod) for all workspaces.
• Tag workspaces with metadata (e.g., Owner: [email protected], Department: Sales).

? Observability

• Monitor workspace usage:
  powershell # PowerShell: Get workspace usage metrics Get-PowerBIWorkspace -Scope Organization | ForEach-Object {
$usage = Get-PowerBIWorkspaceUsage -Id $_.Id
[PSCustomObject]@{
Name = $_.Name
LastActivityDate = $usage.LastActivityDate
ReportCount = $usage.ReportCount
DatasetCount = $usage.DatasetCount
} }
• Set up alerts for:
• Workspaces with no activity in 90 days (candidates for deletion).
• Workspaces with too many admins (security risk).

5. ⚠️ Common Mistakes & Traps

6. ? Exam/Certification Focus (PL-300)

Typical Question Patterns

1. "Which workspace type supports Premium capacity?"
2. ✅ Modern App Workspace

3. ❌ Classic Workspace

4. "How should you share a report with external contractors?"

5. ✅ Publish an App and grant access to their Azure AD group.
6. ❌ Share the workspace link.

7. ❌ Give them "Viewer" access in the workspace.

8. "What’s the difference between a workspace and an app?"

9. Workspace = Development environment (editable).

10. App = Production deployment (read-only, versioned).

11. "Which role can publish an app?"

12. ✅ Admin or Member
13. ❌ Contributor or Viewer

⚠️ Trap Distinctions

7. ? Hands-On Challenge

Scenario:
You’re a Power BI admin. A user complains that they can’t see the latest version of a report. You check and find: - The report is in a Classic workspace.
- The user was given "Viewer" access in the workspace (not via an App).
- The workspace has 3 draft reports that the user shouldn’t see.

Task:
1. Migrate the Classic workspace to Modern.
2. Publish an App with only the final report (hide drafts).
3. Grant the user access via the App (not the workspace).

Solution:
1. Create a Modern workspace (Sales Reports (Modern)).
2. Export/import the final report (not drafts).
3. Publish an App and hide drafts.
4. Grant the user access to the App (not the workspace).

Why it works:
- The user only sees the published App (no drafts).
- The workspace is now governed by Azure AD (better security).
- Future updates can be version-controlled via Apps.

8. ? Rapid-Reference Crib Sheet

9. ? Where to Go Next

1. Microsoft Docs: Modern Workspaces
2. Power BI Deployment Pipelines
3. Power BI REST API Reference
4. PL-300 Exam Guide

Final Pro Tip

"If you’re not using Modern workspaces and Apps, you’re doing Power BI wrong. Migrate today—your future self (and your security team) will thank you."