Forum Discussion
Uncertified visuals data security
Hi OlafCdeWit,
Visuals only have access to the data you add to them. They cannot query the data model of their own volition, so cannot just "reach in and take" whatever they want. Data is only supplied in one direction: from Power BI to the visual.
It is however possible for the data that is supplied to the visual to be sent to an external endpoint via JS. I have not seen any uncertified visuals in AppSource that do this without explicitly stating it in their privacy policy.
I have a slide deck here which has a few diagrams of the visual query process plus some details on the permissions that visuals have. This may or may not be helpful but feel free to ask any specific questions and I'll see if I can provide further details.
Regards,
Daniel
Super UserHi OlafCdeWit,
Visuals only have access to the data you add to them. They cannot query the data model of their own volition, so cannot just "reach in and take" whatever they want. Data is only supplied in one direction: from Power BI to the visual.
It is however possible for the data that is supplied to the visual to be sent to an external endpoint via JS. I have not seen any uncertified visuals in AppSource that do this without explicitly stating it in their privacy policy.
I have a slide deck here which has a few diagrams of the visual query process plus some details on the permissions that visuals have. This may or may not be helpful but feel free to ask any specific questions and I'll see if I can provide further details.
Regards,
Daniel
Hi dm-p ,
This answers my question and reduces my concerns in using uncertified apps.
One more question though: In you slidedeck on slide 8 you show how to check for 'Silent' comms. What is the tool you use for this?
Thank you for your help!
- dm-p
Hi OlafCdeWit, and glad I could be of assistance 🙂
This particular slide highlights a web browser's development tools. With a report open in the service, you can open these up and see what network transactions might potentially be taking place.
You will typically see transactions when data in the visual changes (e.g. through filtering/slicing etc.) as your report is running client-side, whereas the data model is server-side. The report will get latest data from the model over HTTP as and when required.
You could profile a core or certified visual to see what endpoints are typically being called (as these may vary between regions). You could then repeat tests with an uncertified custom visual you're auditioning to ensure that the network profile looks about the same and nothing else is going on.
Regards,
Daniel