on 05 May 2019 09:27:01
A Create workspaces setting exists in the Power BI Admin portal for defining which security groups of users are allowed to create the new app workspaces. While this setting alone is helpful, there should also be a tenant level setting for restricting which users are able to publish or configure a dataset.
If a user is not mapped to a security group assigned the permission to create a dataset, the user will receive an error when publishing the dataset or trying to take over or configure a dataset. The user will of course not be blocked when trying to publish a report based on a live connection to a dataset the user has permission to.