Hi,
We embed reports in our web application for our clients using the Javascript API (App Owns Data). I have a question about the best way of securing the data of a PowerBI report/model.
My simple scenario:
- in my model I have a Sales table (each record is a sale) and a measure "Number of sales"
- the report only have a card that display that measure.
- I don't want the end users to be able to see the content of the sales table (I only want them to see the aggregation value provided by my measure).
I could assume that because in my report I don't display the sales data in a table (I only have a card with my measure) that the user can't see the underlying data of the sales table. But someone with knowledge of the Javascript API could modify the code in the browser and could see that data (for example by activating edit mode, by using it in a custom app with the PowerBI Report Authoring library, etc...).
Am I right in assuming that the only way to prevent this is to aggregate the table in the model and using RLS on the sales tables?
I don't want to scare our clients, but should we say "the model should only have the tables that you want your end users to see. If you don't want users to see some data, don't put it in the model without RLS"?
Thanks!
