Forum Discussion

ovetteabejuela's avatar
ovetteabejuela
Impactful Individual
9 years ago
Solved

Security Risks involving Visuals from app.powerbi.com/visuals

I have done some research in the forum and found a relevant topic however this topic was not so specific onset altough one of the response were. I would like to repost/rephrase and so my question goe...
Need Help
  • MattAllington's avatar
    MattAllington
    9 years ago

    My understanding from presentations I have sat through is

     

    1. No

    2. Yes

    3. Yes

MattAllington's avatar
MattAllington
Community Champion
9 years ago

My understanding from presentations I have sat through is

 

1. No

2. Yes

3. Yes

PatrickNealis's avatar
PatrickNealis
Advocate II
9 years ago

I want to use these custom visuals as well, however seeing the error "Caution: A custom visual could contain code with security or privacy risks" makes this an absolute no-go. I can't afford the potential risk that data could be leaked and I don't have an IT department to scan these visuals for security concerns.

 

Has Microsoft every posted an official response acknowledging that custom visuals on app.powerbi.com/visuals are certified as secure? I dont plan to download any custom visuals from any alternate sources, just that portal.

  • KenSkinner's avatar
    KenSkinner
    Helper I
    7 years ago

    Just checking to see if your question had been answered.  I've found the perfect custom visual in the Power BI Visuals MarketPlace that will save me a tremendous amount of time, but just as I'm about to load it into my Power BI I see the following generic warning:

     

    When this add-in is used, it

     

    • Can read and make changes to your document
    • Can send data over the internet

     

    From what I've seen, this is a common warning for add-ins in the MarketPlace, but some have the "This visual is certified by Power BI".  Just looking for answers to the following:

     

    1. When it states "can read and make changes", I'm guessing they're referring to the actual functionality of the custom visual.  I wanted to add a custom visual that can create dynamic text entries based on filter choices.  Of course it would need to read my data and then change the document.  But is that all it's referring to?
    2. The "Can send data over the internet" is a much bigger concern as I wouldn't want confidential data being piped out to the web in the background.  Is this also referring to just the functionality of the visual or could it theoretically send all my data to a third party without my knowledge?
    3. In Microsoft's "Custom visuals in Power BI" page they state that all custom visuals published in the AppSource (MarketPlace) have been tested and approved by Microsoft for functionality and quality.  For the non-certified visuals, do these test include security threats or privacy violations?
    4. Microsoft's certification requirements include "Does not access external services or resources".  I take it that means it won't funnel my data to a third party without my knowledge?

     

    In Microsoft's "Power BI Support" page they discuss reviewing custom visuals for security and privacy:

     

    https://pbiwebprod-docs.azurewebsites.net/hr-hr/documentation/powerbi-custom-visuals-review-for-security-and-privacy/#considerations-before-you-enable-a-custom-visual

     

    The article shows the warning message Patrick mentioned above and has "considerations before you enable a custom visual".  Are they only referring to custom visuals not downloaded from the MarketPlace?

     

    Answers to any of the above would be appreciated.  Thanks.