Forum Discussion

qp_andy's avatar
qp_andy
Frequent Visitor
6 years ago

Security

Scenario: User has a desktop pro licence at Organisation A, as well as a personal O365 business subscription with Power BI. Question: What security controls exist to stop that user publishing conte...
Need Help
v-joesh-msft's avatar
v-joesh-msft
Solution Sage
6 years ago

Hi qp_andy ,

I'm a little confused by your description. Do you mean to restrict user A's permission to create reports in the workspace? If so, click Access in the workspace to set the user role to Viewer. Roles let you manage who can do what in a workspace, so teams can collaborate. New workspaces allow you to assign roles to individuals, and to user groups: security groups, Office 365 groups, and distribution lists. For more information, please refer to the documentation: 

Organize work in the new workspaces in Power BI

Best Regards,

Community Support Team _ Joey
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

 
  • qp_andy's avatar
    qp_andy
    Frequent Visitor
    6 years ago

    Let me try and make it clearer. There is one user (lets called him Dean) who has his own small IT company (Company A). Company A has an O365 Business subscription, and Dean is the admin and only user ([email protected]). He has a Power BI free user licence on this account so can create in Desktop and publish to his own workspace on PBI service.

     

    Company B hires Dean to work on a Power BI project. Company B creates an AAD user account for Dean ([email protected]) so he can work on their network, and grants a PBI desktop pro licence with his Company B credentials. Dean creates and publishes content using his [email protected] credentials. All good.

     

    BUT....

     

    What is stopping Dean logging in to Company B's network ([email protected]), creating content in PBI Desktop using Company B's data, then logging into the PBI service using his [email protected] account and publishing that content to the Comany A workspace?

    • v-joesh-msft's avatar
      v-joesh-msft
      Solution Sage
      6 years ago

      Hi qp_andy ,

      Power bi cannot limit which account the user uses to publish the report. If you want users to be unable to see content including data and reports on other networks, you can use DirectQuery or Live connection mode to connect to data or connect to a data source such as DataFlow.

      Best Regards,

      Community Support Team _ Joey
      If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

      • qp_andy's avatar
        qp_andy
        Frequent Visitor
        6 years ago
        Seems a major flaw that there is no way to limit the domains/accounts being published to in power bi service, based on the windows account the publisher is logged into? Yes it will all be logged retrospectively, but by then it’s too late....