Forum Discussion
How secure is the Power BI Desktop when using PBXI file
Hello community
I have a general question in regards of PBIX files in PowerBI Desktop:
I like to know if in the PBXI file are connection credentials are saved?
If not, is the location of connectors and PowerBI Service i the User.ZIP file who is saved in the following PATH:
"C:\Users\<user name>\AppData\Local\Microsoft\Power BI Desktop\User.zip" ??
I like to now if it would be possible for a hacker to modify or use that credentials?
For example taking the User.ZIP file and use it on another machine?
Thanks in advance for any response who is helpful...
Kind regards
Michael Damaschke
Hi Anonymous ,
Here is a related thread: https://community.fabric.microsoft.com/t5/Desktop/Where-the-Data-base-username-amp-credentials-get-stored/td-p/1997013
The thread refers a blog post: https://www.sqlgene.com/2018/03/22/are-local-credentials-or-passwords-stored-in-the-power-bi-desktop-file/
The blog post does not confirm anything though and it was written quite back in time.
The pbix files themselves do not store the credentials (they do have cached data but will prompt for credentials when trying to refresh) and even the zip file (stored in local machine) should have those encrypted (not really sure about the vulnerability when copying this over systems). It is better to use the Windows authentication or other secure authentication methods over basic authentication, but I can understand that sometimes you just can't help it.
I hope others can provide more confirming response to your copying zip file to another device concern.PBIX/PBXI files: Do not store passwords in plaintext; safe to share. Users need to re-enter credentials.
User.zip: Stores cached credentials encrypted and tied to your Windows user/machine. Cannot be used on another PC.
Risk: Only if someone has full access to your Windows account.
Safe to share PBIX files; never share User.zip.
6 Replies
- alish_b
Super User
Hi Anonymous ,
Here is a related thread: https://community.fabric.microsoft.com/t5/Desktop/Where-the-Data-base-username-amp-credentials-get-stored/td-p/1997013
The thread refers a blog post: https://www.sqlgene.com/2018/03/22/are-local-credentials-or-passwords-stored-in-the-power-bi-desktop-file/
The blog post does not confirm anything though and it was written quite back in time.
The pbix files themselves do not store the credentials (they do have cached data but will prompt for credentials when trying to refresh) and even the zip file (stored in local machine) should have those encrypted (not really sure about the vulnerability when copying this over systems). It is better to use the Windows authentication or other secure authentication methods over basic authentication, but I can understand that sometimes you just can't help it.
I hope others can provide more confirming response to your copying zip file to another device concern.Hello alish_b
Thanks for the reply.
Well I found some very old information from 2017 and 2018 but thought Microsoft hopefully did increase the security over time.
Important for me is, that if somebody has access to the PBXI file, it is not possible to use existing connections.
We are using 2FA with YUBIKEY so it is a lot more secure as using only credentials.
The problem is still creating an sematic model who makes possible to access data sources like SQL or SharePoint lists is only possible via PowerBI Desktop or via PowerBI Premium in a Premium Workspace on Web (PowerBI Services).
I like to use the Web as otherwise with big data I need to download or using paging which can cause problems. Datamart is super but still Premium... And the equivalent DataFlow works only with tables ;(
But our user are using E5 license with free PowerBI Pro license.
But thanks a lot for your response...
Kind regards
Michael Damaschke
- Shahid12523
Community Champion
PBIX/PBXI files: Do not store passwords in plaintext; safe to share. Users need to re-enter credentials.
User.zip: Stores cached credentials encrypted and tied to your Windows user/machine. Cannot be used on another PC.
Risk: Only if someone has full access to your Windows account.
Safe to share PBIX files; never share User.zip.
Hi Anonymous
Thank you for reaching out to the Microsoft Fabric Forum Community.
Shahid12523 alish_b Thanks for the inputs, I hope the information provided by users was helpful. If you still have questions, please don't hesitate to reach out to the community.