Best Practices for Developing Dashboards Without Direct Data Access

[FelipMark]

Guys, what’s the safest way to develop a dashboard without direct access to the data? I know some access is usually needed, but this came up in a discussion, and I was curious.
Would using a company-managed virtual machine be the best approach, or are there better security-focused solutions?

[Greg_Deckler]

@FelipMark If I understand your question correctly, use I have used "jump boxes" in the past in order to develop Power BI reports. Often this is coupled with a VPN for even more security. 

[WishAskedSooner]

In our org, we have VMs that external developers can only access via a private VPN, and they operate under NDAs. Additionally, they log their changes using version control software. It is not much different from any other software development project. And proper oversight requires a scrum master because there are always individuals who refuse to fully comply. There is no complete panacea beyond in-house development. All the mantras: caveat emptor, ymmv, you get what you pay for, etc. apply.

[parry2k · Accepted solution]

@FelipMark I think this question is more on to the access and security on the data source, not more of a Power BI question.

For example, a SQL server, admin can restrict access to what table a user can do, and also have read only access, and control from which IP a user can access. Once it is all in place, it will be the same using data from SSMS or Power BI.

[FelipMark]

That makes sense, thanks!

[parry2k]

@FelipMark not fully sure about your question, the common way is to create a semantic model in Power BI, publish it to the service and then let use connect to this model and create report. 

[FelipMark]

Let’s say a company hires an external developer to create a dashboards and handling the entire ETL process, but we don’t want to give them direct access to our raw data. What would be the best security-focused approach?

Would a company-managed virtual machine with restricted access be a good solution, or are there other best practices to ensure data security while allowing development?