- [Paul] Hello, and welcome to this video series
on the Power BI Adoption Framework,
which is about empowering every decision maker.
I'm Paul.
- [Manu] And I'm Manu.
- [Paul] And in this video,
we will talk about how to secure Power BI
and control which users can see what data.
Row-level security with Power BI
can be used to restrict data access for given users.
Filters restrict data at the row-level,
and you define filters within roles.
You can configure row-level security for data models
imported into Power BI with Power BI Desktop
as well as datasets that are using DirectQuery
such as SQL Server.
For Analysis Services live connections,
you configure row-level security
in the Analysis Services model,
which is then used by Power BI.
You cannot configure additional security
when using live query datasets.
Another feature of Power BI is dynamic row-level security,
which allows you to determine which rows of data
are available based on data in the model.
The benefit is that it reduces the maintenance overhead
because there's only one role
and the access is controlled by the data itself.
You set this up by having a user table
that joins to the rest of your data.
Say you have a sales table--
the rows may then join or belong to an individual user
or a group of users.
The filter is then applied on the user table
to restrict the data to only records the logged-in user
should see.
To find the username of the logged-in user,
you can you one of two DAX functions:
either username or user principal name.
Username is the current user's domain and password,
whereas the user principal name is the email address
of the account used to log in to Power BI.
Because the username function can return different results
in Power BI Desktop to the Power BI service,
we would recommend you to use the user principal name
function when using dynamic row-level security.
An important thing to note
is that row-level security is only applied to
read-only users in the Power BI service.
If the user has access to edit the reports
or downloads the Power BI Desktop file,
then they'll be able to see all of the data.
The best way to handle this is to share via an app.
If you want to limit all users' data access,
you can implement row-level security
in an Analysis Services model
and use that as the data source instead.
In Power BI, there are a number of ways
to share your reports or dashboards inside
and outside of your organization.
No matter which option you choose
to share a report or dashboard,
you need a Power BI Pro license
or the content needs to be in a Premium capacity.
License requirements vary
for the colleagues who view your reports
or dashboards depending on the option you choose.
If you and your colleagues want to develop reports
and dashboards together and then publish them to other users
in your organization,
the best way to do this is to create an app.
An app is a collection of dashboards
and reports built to deliver
key metrics for your organization.
To create an app, you first need an app workspace
with your colleagues having at least contributor access
to be able to edit the content.
Think of the app workspace as a staging area
where you and they can collaborate
on your Power BI dashboards and reports.
All of you can create reports in Power BI Desktop
and publish those reports to the app workspace.
All of you will need a Power BI Pro license to do so.
Anyone can create app workspaces in the Power BI service
unless this has been restricted
by your Power BI administrator.
When creating an app workspace, you can optionally
configure a workspace OneDrive,
which allows you to configure an Office 365 group
whose SharePoint document library file storage
can be shared by the members of the workspace.
It's very common to be a member of multiple app workspaces.
An individual workspace should contain related reports
and dashboards, which need to all be sent out
to the same audience.
All members of the workspace will require a Pro license
unless they are added as a read-only user.
Once you have an app workspace that contains a number of
datasets, reports, and dashboards,
you might want then to share this with a wider audience.
You can select the reports
and dashboards that you want to include in the app
and then specify which security group,
distribution list, or users you want to share this with.
If the option has not been disabled,
you can also share with the entire organization.
The content that you are sharing is read-only,
although you can tick options to allow users to connect
to the app's underlying datasets
or allow users to make a copy of the reports in this app.
Apps are easy to find
and install in the Power BI service.
You can send your business users a direct link to the app,
or they can search for it in AppSource.
If your Power BI administrator has given you permissions,
you can install an app automatically
in your coworker's Power BI account.
Once an app has been published,
you can continue to create new reports
or update existing ones.
Once you're happy with all of the changes,
you can republish the app
and the users will then see new or updated content.
As an app creator, you need a Power BI Pro license.
For app users, there are two options:
either all business users need a Power BI Pro license
to view an app,
or free users in your organization can view app content
if your app workspace resides
in a Power BI Premium capacity.
You can distribute Power BI content to users outside
of your organization while still maintaining control
over the internal data using the Azure Active Directory B2B.
You can invite guest users that use any email address,
including personal accounts such as gmail.com,
outlook.com, or hotmail.com.
In Azure B2B, these are called social IDs.
There are two ways to invite guest users
to you Power BI tenant:
planned invites or ad hoc invites.
Invitations are needed the first time an external user
is invited to your organization.
A planned invite is performed
within the Microsoft Azure portal in Azure AD
or using PowerShell.
This is the option to use
if you know which users must be invited in advance.
To invite more than one guest user,
we'd recommend you use PowerShell.
To perform an invite at any time,
add the external user to your dashboard
or report through the share UI
or your app through the access page.
The guest user will need to have the proper licensing
in place to view the app that was shared.
There are three options to accomplish this.
You can assign the app workspace to Power BI Premium
capacity, which would allow the guest user to use the app
without requiring their own Power BI Pro license.
Assigning a Power BI Pro license to the guest user within
your tenant would allow them to also view the content.
One final option, the guest user can bring their own
Power BI Pro license if they have one assigned
within their own tenant.
- [Manu] You can share dashboards and reports from most
places in the Power BI service from your Favorites,
Recent, Shared with Me, if the owner gives you permissions,
My workspace, or other workspaces.
When you share a dashboard or report,
those you share it with can view it
and interact with it but can't edit it.
They see the same data that you see in the dashboard
or report unless row-level security is applied.
The coworkers you share with can also share with their
coworkers if you allow them to.
The people outside your organization can view and interact
with the dashboard or report but can't share it.
When you share with people outside your organization,
they get an email with a link to the shared
dashboard or report.
Following this, they have to sign in to the Power BI service
to see it.
If they don't have a Power BI Pro license,
they can sign up for a license after clicking the link.
After they sign in, they see the shared dashboard
or report in its own browser window
without the left navigation pane,
not in their usual Power BI portal.
They have to bookmark the link to access this dashboard
or report again in future.
With sharing, whether you share content inside
or outside your organization, you need a Power BI Pro
license to share.
Your recipients also need a Power BI Pro license
or the content needs to be hosted in a Premium capacity.
Let's face it, some people are more skilled at creating
high-quality, well-designed data models in their reports.
Maybe you're that person.
Your whole organization can benefit from using the same
well-designed data models.
Shared datasets fulfill that role.
You can create a report with the data model
that everyone should use.
You can save that report to the Power BI service
and give the right people permission to use it.
They can then build their reports on your dataset.
That way, everyone is basing their reports on the same data
and seeing the same version of the truth.
With shared datasets in Power BI, we are allowing a single
dataset to be used by multiple reports across workspaces.
To encourage the use of standardized datasets,
IT administrators can mark datasets as certified
when they are authoritative.
Additionally, dataset owners can promote their datasets
that are ready for further exploration by others,
encouraging reuse.
Please note that promoting and certifying datasets
requires a Pro license.
Users without a Pro license can only use a dataset
across workspaces for report authoring if those datasets
reside in the user's personal My workspace
or in a Premium-backed workspace.
The same licensing restriction applies whether they author
reports in Power BI Desktop or in the service.
If you have a report that you want to share with anyone
and everyone, then Publish to web is the sharing option
for you.
The recipients of the report do not require any license,
and anyone can view your report that you embed in your
blog post, website, social media account,
or any other online communication.
Publishing to the web is only available for reports
that you can edit.
You can't publish reports to the web
if they're shared with you
or if they are in an app.
Data refreshes are automatically reflected in
your publicly embedded report or visual.
This can be really useful for marketing teams to share
their reports where the data is already available
to the public.
You can print an entire dashboard,
a dashboard tile, a report page,
or a report visual from the Power BI service.
Reports can only be printed one page at a time.
You can't print the entire report at once.
Printing is only available in Power BI service
and not in Power BI Desktop.
Having said that, the Power BI Desktop tool
has the option to export to PDF,
which is also available in the service.
This option exports all the pages of the report,
and you can, of course, print that PDF.
You can also share this content offline with other users.
With Power BI, you can publish your report to PowerPoint
and easily create a slide deck
based on your Power BI report.
Each page in the Power BI report becomes an individual
slide in the PowerPoint.
Each page in the report is exported as a single
high-resolution image in the PowerPoint file.
The filters and slices that you added to the report
are preserved,
and a link is created in the PowerPoint file
that links back to the Power BI report.
One of our colleagues who works directly with customers
was being asked about the sharing options quite a lot.
So she created a nice table that summarizes when to use
which method.
This table is quite self-explanatory,
so please feel free to pause the video
and review these options.
We have included a link to the slides that we've used
in this presentation in the description below.
Thanks for listening, and if you have any feedback
or questions, please leave a comment below.
See you in the next one.