Direct Query SSO

[mails2thangaraj]

A pro user creates a report using direct query method and publishes the same report to power bi service.

Scenario 1 : When the same user opens the report in power bi service,does it prompt for DB user id & password? or does it use the DB credentials used in enterprise gateway ? if the answer is that it will not prompts, can we make it to prompt for user id & password?

Scenario 2: the same user publishes report as an App from a premium App workspace. Now the app is avilable for all free users, when any free user open the app, does the app prompt for DB username & password? or it will use the DB credentials in gateway 

trying to understand whether Power BI allows the identity of the report consumer to pass through to the underlying source, if not , then what advantage does DirectQuery offers with regard to data source security.

[v-jiascu-msft]

Hi @mails2thangaraj,

Power BI won't prompt for credentials in both scenarios. The credentials should be configured by the owner. If the data source is SSAS, mapping user names is needed. Please refer to service-gateway-enterprise-manage-ssas#usernames-with-analysis-services.

The RLS could be the best security choice. Please refer to power-bi/service-admin-rls.

Security couldn't be a special advantage of Direct Query. When Direct Query will be useful? Please refer to desktop-directquery-about#when-is-directquery-useful. One tip of security, don't share any content to the unqualified users.

Best Regards

Dale

[mails2thangaraj]

I also found this link which states that sso is supported for other 3 DBs:

https://docs.microsoft.com/en-us/power-bi/service-gateway-kerberos-for-sso-pbi-to-on-premises-data

while i understaood you response saying its avialble onyl for SSAS ? Am i missing something here?

[mails2thangaraj]

thanks Dale for responding to my question.

When you say "credentials should be configured by the owner" is this done in the data refresh schedule page? if this is the case then where does the DB Credentials in gateway be used ?

[mails2thangaraj]

A pro user creates a report using direct query method and publishes the same report to power bi service.

Scenario 1 : When the same user opens the report in power bi service,does it prompt for DB user id & password? or does it use the DB credentials used in enterprise gateway ? if the answer is that it will not prompts, can we make it to prompt for user id & password?

Scenario 2: the same user publishes report as an App from a premium App workspace. Now the app is avilable for all free users, when any free user open the app, does the app prompt for DB username & password? or it will use the DB credentials in gateway

trying to understand whether Power BI allows the identity of the report consumer to pass through to the underlying source, if not , then what advantage does DirectQuery offers with regard to data source security.