Security in Power BI web app

[gheesalias]

Hi,

Have some questions regarding implementing security in Power BI web.

1. We have Active Directory set in our Organization. Should we sync it to AAD(Azure Active Directory) and use those AAD logins for login to powebi web and to limit the data access by each role of users in power bi wep?

2. Also, we have security implemented at SQL Server for various roles, will the AAD take over all these security constraints also, when we try to login to Power BI with AAD account?

On another note, which accounts (Organizational AD or AAD?? ) are to be mentioned in Power BI Desktop app for craeting row level secutity?

3. If we build a custom .net web application to show Dashboards, can we make use of Power BI's self service reporting seolution there? 

[v-micsh-msft]

Hi gheesalias,

To answer your questions:

1. Power BI requires work/School email address to sign up, which is your organization account, AAD login could be Microsoft Account, or your organization account, if you would like to have both works with the same account, be sure to signup with Organization Account. Local AD resources can't be synced with Power BI if it hasn't been combined with AAD, as the authentication will fail. Reference: How to use the same account login for Power BI and Azure

2. Connecting SQL server would ask for credential type in Power BI, we could choose Windows credential, or SQL server Credentials. AAD won't affect the security hierarchy at the data source side, combining Local AD with AAD offers the benifits of verifying domain users with online services (Office 365 and Azure resources). It will not affect the local security, unless you change it.

Row Level Security requires organization account, check the shared articles posted in question 1.

For question 3, I am not fully understand the meaning. For self-designed apps, Power BI have its own way to embed the dashboard or reports. Check: What can developers do with Power BI?

If you have any further concerns, please post back.

Regards

[gheesalias]

Hi @v-micsh-msft,

Many Thanks for the explanation, that really helped. 

Have some more questions to this.

1 & 2. Please corerct me if I am wrong, this is my understanding about your point 1. 

I have only organizational AD for now, so for me to give access to around 1000 users in my AD, I will have to sync them to Azure AD using Azure AD Connect tool.

Now, even thogh the Analysis Cube which I use for reporting has got row level security checks for the different roles/users in Org AD, I will have to promote them to RLS in Power BI Desktop for them to have security at report level using my AAD account.

3. My question here is, in Power BI web, we can change the visualizations with "Q & A" feature for Dashboards, but if we go with a Custom .net web app to showcase the Power BI dashboards, is this option available for the user to write Q & A to change visualizations on the fly?

[v-micsh-msft · Accepted solution]

Well,

I think sharing the blog would be better than my explanation.

3 Scenarios to Understand Azure Active Directory Better with Power BI

For question 3, currently I don't think it's possible.

Regards