How to list shared Dynamics records and user access levels with Power BI

We all know about the POA table (principalobjectaccess) that holds information about what records are being shared, to what users/teams, and at what access levels. Here I will show how to report such information with Power BI.

First, a recap of important POA table columns:

• objectid: GUID of the record being shared
• objecttypecode: logical name of the record being shared
• principalid: GUID of the user/team/organization the record is shared with
• principaltypecode: has value of systemuser, team, or organization, depends on above principalid
• accessrightsmask: mask value representing level of access rights to the shared record. 

Let's focus on a concrete use case for this report: I want to see a list of shared Cases, along with the users being shared, and what access level is being granted. The end result would look like this:

Step 1: Launch Power BI Desktop. At the time of this writing Power BI online does not support Dataverse or CDS, the 2 data sources we need for this task. Create a blank report.

Step 2: Get data for 3 tables systemuser, incident, and principalobjectaccessset. The first 2 tables you will get data from Power Platform | Dataverse. The last table POA you will have to get it from Common Data Service (Legacy) source

Step 3: Establish relationships between tables. Switch to Model view. 

Create Many-to-one relationship from principleobjectaccessset/objectid to incident/Case(incidentid).

Create second Many-to-one relationship from principleobjectaccessset/principalid to systemuser/User(systemuserid)

Step 4: Create the report. Switch to Report view and choose the columns from Data tab for the report. On Filters tab, filter column objecttypecode to incident, filter column principaltypecode to systemuser

Now you have the report. My sample includes 2 Case records being shared with few users with different access levels (1 - read; 3 - read, write; 7 - read, write, append)