topic Re: Grant permission with embedded Power BI in Developer

Grant permission with embedded Power BI

Anonymous — Tue, 15 May 2018 13:38:56 GMT

Hello to all,

My scenario is this:

I would like to share a power BI report with non-Power BI users, such as with customers or members of my organization who do not use Power BI.

I created a sample application, with an access token for non-Power BI users (app owns data). I followed all the documentation available online, for example this content: https://docs.microsoft.com/en-us/power-bi/developer/get-azuread-access-token

It works! But I have a doubt.

Although I will implement a mechanism to allow access to the page only to authorized users, the user will have access to a web page containing javascript scripts. By displaying the source code, the user can obtain: object ID, token, report ID.
So if the user sent this information to another user, the last one could access the report with simple technical operations.
Even if I set a very short expiration time for the authentication token, there would always be this problem.

How could I make an embedded report by api really reserved for a single group of users?

Re: Grant permission with embedded Power BI

v-micsh-msft — Thu, 17 May 2018 02:59:12 GMT

Personally I think this should be guaranteed through the Application authentication.

By the way, the users who have the rights to access the source code should be restricted.

Further, within Power BI Embedded, you could set up Row Level security:

Use row-level security with Power BI Embedded content

Regards,

Michael

Re: Grant permission with embedded Power BI

Anonymous — Mon, 21 May 2018 09:58:13 GMT

Thank you @v-micsh-msft!

Your answer clarified my ideas.
Through the application authentication it's possible to restrict access to whoever you want. In addition there are several mechanisms to prevent the reading of javascript code.
If all this is not enough, I could set up row Level security: in thise case the embedded tokens can be generated with permissions limited to a specific role.
Thanks so much!