SharePoint embed bypassing security

[stobbea]

My IT department is telling me that when you embed a PowerBI Dashboard on a modern SharePoint team site, that the team site permissions overwrite the PowerBI permissions. This sounds very strange.

Someone at my company has built a PowerBI dashboard that I previously had access to. He then removed permissions for me. This causes me not to be able to access the dashboard anymore in the PowerBI experience. *But* for some reason I can still see and interact with it from the SharePoint page. This seems like a security risk, and my expectation was that SharePoint would rely on the sharing at the PowerBI level.

Can anyone provide clarification?

[spawlowski21]

Whomever built the dashboard most likely used the "Publish to Web" option when choosing to embed on a sharepoint site which has no security built in, if you were to paste that code into any HTML website the entire web could see this. THat person most likely did that because the "Embed in sharepoint" option is only available on the newest version of sharepoint so you unless you dont have the latest version, then you can unsecurely embed on a sharepoint site. Unfortunately thats how microsoft keep you coming back for more. 

Hope this helps!

[Anonymous]

@stobbea,

Do you follow the guide in this article to embed Power BI report in SharePoint online? If so, I am not able to reproduce this issue, if I don’t grant the user access to the report in Power BI Service, the user can’t view embedded report in SharePoint Online

Regards,
Lydia

[stobbea]

My IT department is telling me that when you embed a PowerBI Dashboard on a modern SharePoint team site, that the team site permissions overwrite the PowerBI permissions. This sounds very strange.

Someone at my company has built a PowerBI dashboard that I previously had access to. He then removed permissions for me. This causes me not to be able to access the dashboard anymore in the PowerBI experience. *But* for some reason I can still see and interact with it from the SharePoint page. This seems like a security risk, and my expectation was that SharePoint would rely on the sharing at the PowerBI level.

Can anyone provide clarification?