Public Web Report Data Security Through PowerQuery Transformation

[MarkDuslak]

I have been struggling to find a definitive result on whether creating a public report opens the chance for data misuse, breaches, etc.

For context, I work in higher education and we are seeking to create a public report to provide community access to aggregated college data (graduation rates, enrollment, etc.). Our current model has tables with personally identifiable information (PII) (e.g. names, addresses, phone, email).

If I remove these columns through PowerQuery, restrict drill-downs, and use only explicit measures instead of implicit measures in the report, are these enough safeguards to prevent someone from accessing the PII? I'm planning to use a data connection to our Student Information System that refreshes daily, but I have spoken to colleagues who recommend using a static dataset and updating it manually once a year. Are there any additional security issues posed by using data that is directly connected to our Student Information System that I should consider?

[Greg_Deckler]

@MarkDuslak You are going to use an Import mode semantic model, correct?

[MarkDuslak]

@Greg_Deckler ,Yes. Import mode, not direct query or composite.  I should've been more detailed in the original explanation.  Our student information system is an Oracle database.  That data is queried via SQL and tables are created.  The tables are housed in an Azure blob and are imported to Powerbi.

[Greg_Deckler · Accepted solution]

@MarkDuslak I would say that as long as you strip out all the PII you should be good. Something that you can consider is the pre-aggregate the data into tables using Power Query. I don't see any risk just having it refresh in the Service. The Service encrypts the credentials and it isn't exposed in any way publicly.