It would be helpful to have a pattern outlined specifically for PowerBI report publishing in enterprises. Use of SGs to grant report access (whether published as apps or not), and self service SG mgmt. and approvals using Azure AD. This needs to scale to 100s or 1000s of reports, so visual display and finding of reports then requesting opt-in access via associated SG would be needed.