- [Paul] Hello, and welcome to this video series
on the Power BI Adoption Framework,
which is about empowering every decision maker.
I'm Paul.
- [Manu] And I'm Manu.
- [Paul] And in this video, we will give an overview
of the security architecture in Power BI.
A tenant is a dedicated instance
of the Azure Active Directory service
that an organization receives and owns
when it signs up for a Microsoft cloud service,
such as Azure, Microsoft Intune, Power BI, or Office 365.
Each Azure AD tenant is distinct and separate
from others Azure AD tenants.
A tenant houses the users in a company
and the information about them, their passwords,
user profile data, permissions, and so on.
It also contains groups, applications, and other information
pertaining to organization and its security.
The data region is based on the country you select
when you create the tenant.
The selection applies to sign up for both Office 365
and Power BI because this information
is shared between them.
Each Power BI deployment consists of two clusters,
a web front-end cluster and a back-end cluster.
The web front-end cluster manages the initial connection
and authentication process for Power BI,
using Azure Active Directory to authenticate clients
and provide tokens for subsequent client connections
to the Power BI service.
Power BI also uses the Azure Traffic Manager
to direct user traffic to the nearest datacenter
for the authentication process
and to download static content and files.
Power BI uses the Azure Content Delivery Network
to efficiently distribute the necessary static content
and files to users based on their geographical locale.
The back-end cluster is how authenticated clients
interact with the Power BI service.
The back-end cluster manages visualizations,
user dashboards, datasets, reports, data storage,
data connections, data refresh, and other aspects
of interacting with the Power BI service.
The Gateway role acts as a gateway between user requests
and the Power BI service.
Users do not interact directly with any roles
other than the Gateway role or Azure API Management.
It's important to note that only Azure API Management
and Gateway roles are accessible
through the public internet.
They provide authentication, authorization, DDoS Protection,
throttling, load balancing, routing, and other capabilities.
In the Power BI service, data is either at rest,
meaning that the data is available to a Power BI user,
but it's not currently being used or it's in-process.
For example, queries are being run, data or models
are being uploaded to the Power BI service,
or any other action that users or the Power BI service
may take on data that is actively being accessed or updated.
Data at rest in Power BI is encrypted.
Data that is in transit, which means data being sent
or received by the Power BI service is also encrypted.
Data and metadata for Power BI are stored
in Azure Blob storage and Azure SQL Database.
And all data at rest in Power BI is fully encrypted.
Datasets are made up of three parts:
metadata, which consists of tables, columns, measures,
calculations, connection strings, et cetera.
Credentials, and then the data itself.
All the metadata for transformations, DirectQuery,
and push data are encrypted and stored
in Azure Blob storage.
For credentials to the original data source,
these are either stored in a Blob storage
or Azure SQL if it's a cloud source,
or on-premises with the gateway.
Data is stored encrypted in Azure Blob storage
or in Azure SQL for push data.
And for live query and DirectQuery connections,
no data is stored.
Reports are made up of metadata, static data, caches,
and the original Power BI Desktop file.
Metadata and visual data caches are stored
in Azure SQL Database.
Static data is held in Blob storage along with
the Power BI Desktop file temporarily after upload.
For dashboards and dashboard tiles, the data needed
by the visuals on the dashboards are usually cached
and stored encrypted in Azure SQL Database.
Other tiles such as pinned visuals from Excel,
or SQL Server Reporting Services are stored
in Azure Blob as images and are also encrypted.
Static data such as background images and custom visuals
are stored encrypted in Azure Blob storage.
The encryption keys for Azure Blob storage
are stored encrypted in a separate location
of the Power BI service.
The encryption keys for Azure SQL Database's,
transparent data encryption technology
are managed by Azure SQL itself.
The encryption key for the data movement service
and on-premises data gateway are either stored
on-premises in the data gateway on customers' infrastructure
for on-premises data sources or in the data movement role
for cloud-based data sources.
The content encryption key used
to encrypt Azure Blob storage
is a randomly generated 256-bit key.
The algorithm that the content encryption key uses
to encrypt the content is AES_CBC_256.
The key encryption key that is used to then encrypt
the content encryption key is a predefined 256-bit key.
The algorithm used by key encryption key to encrypt
the content encryption key is A256KW.
Gateway encryption keys, which are based on the recovery
key, never leave an on-premises infrastructure.
Power BI cannot access the encrypted
on-premises virtual credentials
and cannot intercept those credentials.
Web clients encrypt the credential with a public key
that's associated with a specific gateway
with which it's communicating.
For cloud-based data sources,
the data movement role encrypts encryption keys
using always-encrypted methods.
Data is in-process when it is actively being used
or accessed by a user.
For example, data is in-process when a user accesses
a dataset, revises or modifies a dashboard or report,
when a refresh occurs, or other data-access activities
that may occur.
When any of these events occur and put data in-process,
the Data role in the Power BI service creates
an in-memory Analysis Services database,
and the dataset is loaded into that in-memory database.
Whether the dataset is based on DirectQuery or not,
data loaded into the AS database is unencrypted,
to allow for access by the Data role,
and held in memory for further access
until the Power BI service no longer needs the dataset.
For customers with a Power BI Premium subscription,
Power BI creates an in-memory Analysis Services database
in the customers' separately provisioned collection
of Power BI virtual machines.
Once data is acted upon, which includes
initially loading data into Power BI,
the Power BI service may cache the visualization data
in an unencrypted Azure SQL database
regardless of whether the dataset
is based on DirectQuery.
To monitor data integrity for data in-process,
Power BI uses HTTPS, TCP/IP, and TLS to ensure data
is encrypted and maintains integrity during the transport.
- [Manu] Another important question that we hear
from almost all customers is, "Where is my data stored?"
When you first sign in, you can choose where your tenant
is created, and your data will always reside in this region.
If you already have Office 365, your Power BI tenant
will be created within the same datacenter.
If you want to see where your tenant is located,
then you can click on the question mark
in the top right-hand corner of the Power BI service,
and select About Power BI.
It is important to note that all of your data
will be held in this region but not just within
that datacenter.
For resiliency, your data is held
in at least two datacenters within the same region.
So if there were any issues with one datacenter,
then Power BI can fail over
to the other datacenter in the same region.
All regions are within the same data sovereignty
and are located in the same geography.
For example, if my data was held in North Europe,
which is in Ireland, then it would be backed up
to West Europe, which is in Netherlands.
For UK South, it will be backed up in UK West.
For more information, you can go
to the Microsoft Trust Center.
During the preview, the audit data was stored in the US,
and one of the most frequent questions we were being asked
was, when will this data be stored in their data region?
Gladly, now we can tell that your audit data
is stored in the same region as your data.
With Power BI and ExpressRoute, you can create
a private network connection from your organization
to Power BI, bypassing the internet to better secure
your sensitive Power BI data and connections.
ExpressRoute is an Azure service that lets
you create private connections between Azure datacenters
where your Power BI data resides
and your on-premises infrastructure,
or create private connections between Azure datacenters
and your co-location environment.
ExpressRoute also gives you a built-in redundancy
in every peering location for higher reliability,
as well as a dedicated connection
that you can dynamically scale up
without loss of connection.
Power BI is compliant with ExpressRoute
with a few exceptions where Power BI gets or sends data
over the public internet.
Power BI uses multiple content delivery networks or websites
to efficiently distribute the necessary static content
and files to users based on their location
through the public internet.
These static files include product downloads
such as Power BI Desktop, on-premises gateway,
or Power BI content packs
from various independent service providers.
This also includes browser configuration files
that are used to initiate and establish
any subsequent connections with Power BI,
as well as the initial secure Power BI login page.
However, the actual credentials are only sent over
through the ExpressRoute.
Telemetry data includes usage statistics and similar data
which is transmitted to services that are used
to monitor usage and activity.
Map Visuals require connection and data transmission
to the Bing Virtual Earth service
or the Bing Geocoding service, each of which
is established over the public internet.
Power BI integration with Cortana requires access
to Bing over the public internet as well.
When custom links are added by a user,
such as an image widget or a video, Power BI requests data
based on the link provided by the user,
which may or may not use the ExpressRoute.
In addition to these, users can send feedback to Power BI
in text, and optionally in images
over the user voice feedback mechanism,
which uses the public internet for transmission.
The Bing News content provider downloads content
from Bing using the public internet as well.
When connecting to apps, for example, content packs,
users are often required to enter credentials
and settings using pages provided by the software
as a service provider.
Such pages may or may not use the ExpressRoute.
ExpressRoute may or may not be required
in your organization.
So at this point, please pause and have a discussion
about why you need it
and whether there's business justification
for making this investment.
Once you've had that discussion, if you do want to go ahead,
then we've listed the key steps that are involved.
So please note down your decision
and the next steps in your strategy document.
When using Power BI, you can be assured that your data
is held in accordance with stringent industry safeguards.
The business applications platform complies
with the standards listed in this slide.
And compliance is verified
by third-party audits and certifications.
You can also see the regions
that Power BI data can be stored in.
This information is subject to change
and gets updated quite regularly,
so please check the latest version
of the Power BI Trust Center for compliance
and market availability.
If you're looking for guidance
on how to implement ExpressRoute with Power BI
or you want to see what services our partners
can offer in this space,
then please check out the Marketplace.
The link is in the description below.
We have included a link to the slides that we've used
in this presentation in the description below.
Thanks for listening, and if you have any feedback
or questions, please leave a comment below.
See you in the next one.