Learn about the Power BI security best practices to protect your valuable data. Discover the importance of user authentication, ADD integration, user permissions, row-level security, object-level security, and more

1. Sparity Soft Technologies
https://www.sparity.com
Power BI Security Best Practices
In the modern business landscape, companies are increasingly recognizing the immense value of
incorporating data analytics and business intelligence tools into their operations. By leveraging these
advanced technologies, organizations can gain valuable insights that empower them to make more
informed decisions and drive enhanced performance. However, data security is has become a
paramount concern and increasingly challenging due to the widespread availability of data sources and
the number of individuals who have access to such data. The utilization of self-service business
intelligence (BI) by business users to access data has experienced significant growth across all industries.
Power BI facilitates seamless data manipulation through real-time, comprehensive analytics, robust
modeling capabilities, and customizable development options. The dynamic and progressive nature of
technology introduces inherent security risks alongside its potential advantages. One of the most
significant challenges that companies utilizing Power BI face in terms of data security is primarily
attributed to the extraction of data from operational systems. Published and shared reports frequently
bring to light the alarming issue of data being left unprotected, thereby contravening established IT
policies as well as legal and regulatory obligations. Unfortunately, a significant number of businesses
find themselves uncertain about the most effective Power BI Security practices and strategies to combat
attackers or insider threats, resulting in their susceptibility to catastrophic data breaches.
In this blog post, we look at some of the Power BI Security best practices that business can implement to
secure their data.
Power BI Service architecture
Microsoft Power BI is a cutting-edge software-as-a-service (SaaS) solution that operates seamlessly on
the highly reliable and secure Azure cloud computing platform. The architecture of the Power BI service
revolves around two key clusters: The Web Front End (WFE) cluster and the Back-End cluster. These
clusters form the backbone of the Power BI service, working in tandem to deliver a seamless and
efficient user experience. Let's delve deeper into the intricacies of these clusters and understand their
roles in the Power BI ecosystem.
The WFE cluster plays a crucial role in overseeing the initial connection and authentication process to
the Power BI service. Once successfully authenticated, the Back-End takes charge of managing all
subsequent user interactions. Power BI leverages the robust capabilities of Azure Active Directory (AAD)
for the secure storage and efficient management of user identities. These identities are stored in Azure
Blob, ensuring a reliable and scalable solution. Additionally, Power BI effectively handles the storage of
data and metadata by utilizing Azure SQL Database. To ensure utmost security, encryption at rest is
employed, allowing users to bring their own encryption key for enhanced control and protection.
Furthermore, Power BI effectively utilizes the Azure Traffic Manager (ATM) to optimize traffic routing.
By leveraging the DNS record of the client, Power BI intelligently directs users to the nearest Web Front
End (WFE) for seamless authentication and efficient retrieval of static content and files. Power BI

2. leverages the robust Azure Content Delivery Network (CDN) to seamlessly and optimally disseminate
essential static content and files to users, taking into account their specific geographical location.
Power BI Security best practices
Use Azure AD Conditional Access for User Authentication
The authentication process in Power BI is effectively managed and regulated by the robust Azure Active
Directory (AAD) system. The Software-as-a-Service (SaaS) platform leverages the customer's unique
login credentials in order to provide seamless access to the desired resource. To access the Power BI
platform, users are required to log in using the email address associated with their Power BI account.
When utilizing Power BI, your login email serves as your designated username, seamlessly transmitted
to resources each time you endeavor to establish connections with various data sources. The username
is effectively linked to the User Principal Name (UPN) and subsequently authenticated through a
Windows domain account.
The utilization of Azure AD Conditional Access enables the acquisition of additional levels of security
pertaining to access authentication. In addition, it is possible to incorporate best practices, which
encompass: Multi-factor authentication (MFA), Restrict access from specific Operating Systems,
untrusted locations and individual utilizing mobile devices.
Set up user permissions
Workspace: Within a Workspace, users have the option to assume one of four distinct access roles:
Admin, Member, Contributor, or Viewer. These roles serve as essential designations that determine the
level of permissions and responsibilities granted to individuals within the Workspace environment. By
assigning these roles strategically, Workspace administrators can effectively manage and control the
flow of information and collaboration within their respective Workspaces. The Viewer role, carefully
crafted to cater to the needs of end-users, offers the lowest level of privileges. Its primary purpose is to
grant users the ability to access and view reports effortlessly. Users who possess Workspace View
Access have the ability to effortlessly access and explore any reports that reside within the designated
Workspace. Later in this article, we will delve into an exceptional case that deviates from the
aforementioned rule.
Direct access /link: One alternative method for granting users report permission is to provide them with
direct access to the report or send them a link to the report hosted in the Workspace. In this case, there
is no need for Viewer permission on the Workspace, as the report access is provided through the link. By
default, only users with the Workspace Admin and Member roles have the ability to share reports using
this approach.
Power BI App: You have the option to publish all or a selected subset of reports from a Workspace to the
Power BI App. Currently, there is a one-to-one relationship between a Workspace and an App. This
means that each App can only host reports from one Workspace, and each Workspace can only publish
reports to one App. Apps offer enhanced flexibility in managing user access, as the access of an App user
is determined separately from the underlying Workspace. Report designers have the ability to
incorporate supplementary navigation within the applications and install applications for end users

3. within the Power BI service. By default, only users with the Workspace Admin and Member roles have
the ability to publish reports into Apps.
These three methods for setting user permissions can be used together or separately. A general
recommendation is to begin by clustering the themes of the report and categorizing users into groups
based on their specific reporting needs. This will help in organizing the Workspaces & Apps accordingly.
Enable Row-Level Security (RLS)
Row Level Security (RLS) is a mechanism that is employed to limit the access of specific users to data at
the row level. This enhanced level of security provides administrators with greater control over users'
access to data, allowing for more precise and detailed management. Row-level security allows
administrators to exercise control over the specific rows or records that users or groups can access
when they interact with a database allowing them to finely tune and precisely manage users' access to
critical data. This feature enables users with restricted access to securely view the database and execute
queries, minimizing the potential risk of unintentionally exposing sensitive data.
Row-level security (RLS) allows you to publish a single report to your users while customizing the data
exposure to cater to the unique requirements of each individual. Rather than making numerous reports
with different information for different users, you can generate a single report that will only display the
information that the currently logged-in user is authorized to view. Data access restrictions are
implemented through the utilization of filters, which effectively limit the accessibility of data at the row
level. These filters are established within designated roles, enabling precise control over data access.
In addition, Power BI Desktop offers a seamless experience for configuring Row-Level Security (RLS)
across multiple data models imported into the platform. In addition, it is worth noting that Power BI
offers the capability to configure Row Level Security on datasets that utilize DirectQuery (DQ)
functionality, such as SQL Server. This feature empowers users to enhance the security and privacy of
their data by controlling access at a granular level.
Utilize Object-level security (OLS)
Object-level security functions by operating at the level of tables or columns, as opposed to individual
rows. Object-level security is a security feature that enables the safeguarding of sensitive tables or
columns from unauthorized access by report viewers. By utilizing the Object-level security, businesses
can effectively restrict certain users from accessing sensitive information like customer credit card
numbers, SSN/SIN, and other confidential data. From a user's perspective without appropriate access
privileges, the secured tables or columns are not visible or accessible. The process of generating OLS
roles and authoring OLS rules in the Power BI dataset can be accomplished using Power BI Desktop and
other tools that leverage the XMLA endpoint, such as Tabular Editor.
Restricted Sharing: Restrict the sharing of reports and dashboards exclusively to individuals who require
access. It is imperative to refrain from publishing reports and dashboards to the general public or
individuals who lack proper authorization.
Employ certified visuals
Power BI certified visuals refer to custom visuals available on AppSource that have successfully
undergone comprehensive quality testing. Certified custom visuals are subjected to rigorous verification

4. by Microsoft to ensure the presence of robust and high-performance code. Only custom visuals that
have been certified are capable of being viewed in Export to PowerPoint mode and email subscriptions.
Classify report data according to business impact
Power BI sensitivity labels can be utilized to categorize data based on its level of business impact,
distinguishing between high, medium, or low impact. The sharing of High Business Impact (HBI) data
externally necessitates users to seek a policy exception. Data with a Low or Medium Business Impact
(LBI/MBI) does not need special handling. The implementation of Power BI data sensitivity labels helps
to enhance user awareness regarding security measures and proper sharing protocols for reports within
and outside the organization.
Carryout Audit
Having knowledge of the individuals responsible for specific actions on items within your Power BI
tenant is crucial for your organization to meet its requirements, such as regulatory compliance and
records management. Power BI offers two options for tracking user activity: The Power BI activity log
and the unified Office 365 audit log both provide a comprehensive record of Power BI auditing data.
These logs allow you to access detailed information about all Power BI activities. The audit logs have a
data retention period of 90 days. Therefore, it is recommended to store the data and generate reports
using Power BI.
Utilize HTTPS: Employ the utilization of HTTPS protocol to establish an encrypted channel for secure
communication between the client and the server. The implementation of this security measure
guarantees the safeguarding of data against unauthorized interception and tampering.
Establish Password polices
Implement robust password policies to enforce the usage of strong passwords, thereby enhancing the
security of user accounts by minimizing the likelihood of password guessing or cracking. It is highly
recommended that users employ distinct passwords and changing them frequently.
User Training
Provide comprehensive information to your users regarding the significance of data security and the
proper utilization of Power BI security features. Ensure that individuals have a clear understanding of
the established policies and procedures pertaining to the access and utilization of reports and
dashboards
Ensure Power BI is Up-to-Date
It is imperative to regularly update Power BI with the most recent security patches and updates. This
practice guarantees that all identified vulnerabilities are addressed, thereby ensuring the security of
your reports and dashboards.
Conclusion
Power BI encompasses the domains of data analytics, data visualization, and business intelligence. The
software is widely utilized by Data Professionals worldwide for the purpose of analyzing data from
various sources and generating visually appealing Charts, Dashboards, and Reports based on user-

5. defined data parameters. Ensuring the security of reports and dashboards in Power BI is of utmost
importance in safeguarding sensitive data against unauthorized access and potential data breaches.
Power BI offers many security features, such as Use of Azure AD Conditional Access for User
Authentication, setting up user permission, Row-Level Security, Object-level security and data
encryption for enhanced security. Furthermore, along with the security features provided by Power BI,
implementing best practices, such as restricted sharing, employing certified visuals, classifying report
data according to business impact, carryout Audit, adopting HTTPS protocol, establishing password
polices, providing user training and keeping Power BI updated, you can significantly enhance the
security of your Power BI platform and safeguard your valuable data. By adhering to these
recommended guidelines, you can guarantee the utmost security for your reports and dashboards,
thereby safeguarding your valuable data.