PowerBI Embedded - Same Report, Multiple Tenants

[SuperTommy]

I am in the process of building a multi-tenant application that requires visualizations. I am exploring PowerBI embedded for this purpose. I cannot use Power BI's row level security as data from each tenant cannot be in proximity to another tenant's data.

Each client will have different data sources but will need access to the same PowerBI report template. The only difference between clients and their reports will be the data sources their report points to. 

Here's how I am approaching this problem:

1. Create a dedicated PowerBI Pro user.
2. With that user, register a PowerBI Native App at dev.powerbi.com/apps
3. Create a PowerBI Workspace
4. In that Workspace, create a PowerBI Report to use as a template for all my customers.
5. In my web application
   1. For each new client
   1. Create a Workspace
   2. Create PowerBI Datasets for the client
   3. Clone the Report template into the client Workspace and associate it with the Datasets created above.
   4. As new data comes in, update the PowerBI Datasets
   1. Use the GenerateToken method to create a token for their specific report. Embed this token and their report in the client's page.
1. Use the Client ID created above and my dedicated PowerBI user's credentials to get Access Token.
2. With this access token, use the PowerBI REST API to do the following:
3. When the client requests the report...

My concerns with this approach are the following:

1. The report doesn't have user level authentication with my application. Someone could just extract the embedded report URL/token and pass it along.
2. I am duplicating the Report. If I need to make a change to the report format, I need to propagate that change to all the cloned Reports.
3. I am polluting my Azure AD tenant with groups from the Workspaces (one Workspace per client). I'm not even sure I need the Workspaces.
4. I need to track metadata for all my PowerBI Datasets and Reports. If I don't, I will not know which PowerBI Datasets are compatible with which PowerBI reports.

How does this approach sound? Are there more sensible alternatives for my desired result?

Any input would be greatly appreciated!

[Anonymous]

Hi @SuperTommy,

I have also written a blog post on this topic that may give you some more insights.

Thanos

[Anonymous]

Hi @SuperTommy,

we have implemented a similar solution. I have already shared some of the implementation decisions in this answer.

Hope this helps. 

Regards,

Thanos

[v-micsh-msft]

There are some limits with the current Power BI REST API.

So I am afraid currently there is no proper way to overcome some of your concerns.

1. For security concern, please consider add authentication to your Application,

2. You may take a look at the following blog, which may help in your scenario,

3. If each group represents a different tenant, it is recommendded to have it in different workspaces,

4. Consider set up Data Refresh, you could re-bind Power BI Reports to the proper dataset with the Rebind API:

https://msdn.microsoft.com/en-us/library/mt784672.aspx

Regards,

Michael