PowerBi gateway - Data integrity and least privilege

[urraghu]

I am using PowerBI gateway to connect to on-premise sql DB and import the data(in few tables) for creation of reports. Everything was setup successfully... But there are few security concerns raised reg data integrity and how can we ensure least privilege (meaning if a column in a table is not needed then powerBi should not have access ) ?

In other words, The internal on-prem data (column/table/db) which is not needed should not be exposed to PowerBI since it is an external cloud service.

would appreciate any help/pointers which supports Power Bi gateway data integrity and least privilages concept in the case mentioned above.

[v-xuding-msft]

Hi @urraghu ,

It is not supported for data gateway. If you import data in Desktop and then publish to Service, you could use use T-SQL queries to return specific data.

Reference: 

Power BI Introduction: Working with SQL Server data in Power BI Desktop — Part 5 

If you want to hide data for different users, you could try RLS. Please reference:

Row-level security (RLS) with Power BI 

(Note: It is based on rows rather than columns. If use it, we need to transform data firstly)

[urraghu]

Hi @v-xuding-msft 

Thanks for your response.

to eliminate this unwanted data exposure to PowerBi data gateway , We are thinking to eliminate the data gateway completely by pushing the data first to azure sql from one-premise sql (as an intermediatry step ) and then connecting get data to Power BI directly from Azure SQL. 

do you also think this would be a better option in aspects of least privilage and data integrity ? any inputs/ideas on this would be appreciated. Thank You.

[Wimverh]

This is not related to gateway but to the security on your source system. 

When you create your gateway, a user is required, and this user will define what can be accessed.

Best approach is to create views, and only give access to the views with the minimal required data. 
If you are on sql server, you create them in a specified schema, then all views in the schema would 
be visible to power bi.