Forum Discussion
Power BI Embedded vs Publish to Web
Just knowing the EmbedUrl is not enough to load a Power BI report using the Power BI embedding model. It also requires an Azure AD token or an embed token. Any attacker with an EmbedUrl would then have to go through the authentication process with Azure AD to acquire either an Azure AD token or an embed token.
The URL used for Publish to Web has an embed code (not an embed token) at the end which provides anonmyous access. That means that Publish to Web works without requring any form of user authentication. If you have the URL with the embed code at the end, you are able to view the report. That's why we say the Publish to Web is inherently insecure.
Power BI embedding, on the other hand, will always require authentication with Azure AD. Today, Power BI embedding requires that a specific user with enough permissions to authenticate to acquire an access token. The access token is passed back to the browser for embedding when using first-party embedding and the user-owns-data model. With third-party embedding, the access token is used to call to the Power BI Service API to retrieve an embed token, and it is the emebd token not the access token which is then passed to the browser.
The bottom line is that Power BI embedding is secure while Publish to Web is not.
Publish to web from Power BI Limitations
https://docs.microsoft.com/en-us/power-bi/service-publish-to-web#custom-visuals
Custom visuals
Custom visuals are supported in Publish to web. When you use Publish to web, users with whom you share your published visual do not need to enable custom visuals to view the report.
Limitations
Publish to web is supported for the vast majority of data sources and reports in the Power BI service, however, the following are not currently supported or available with Publish to web:
- Reports using row level security.
- Reports using any Live Connection data source, including Analysis Services Tabular hosted on-premises, Analysis Services Multidimensional, and Azure Analysis Services.
- Reports shared to you directly or through an organizational content pack.
- Reports in a group in which you are not an edit member.
- "R" Visuals are not currently supported in Publish to web reports.
- Exporting Data from visuals in a report, which has been published to the web
- ArcGIS Maps for Power BI visuals
- Reports containing report-level DAX measures
- Single sign-on data query models
- Secure confidential or proprietary information
- The automatic authentication capability provided with the Embed option doesn't work with the Power BI JavaScript API. For the Power BI JavaScript API, use the user owns data approach to embedding. Learn more about user owns data.
Tenant setting
Power BI administrators can enable or disable the publish to web feature. They may also restrict access to specific groups