Forum Discussion
Advocate IIDirect access for Power BI reports and enforcing VPN connection
Hi sba_ur ,
Thank you for your follow-up question. Although Power BI and Microsoft Fabric do not provide a native workspace-level option to limit access by geographic location, you can achieve this by implementing Microsoft Entra ID (formerly Azure Active Directory) Conditional Access policies.
Conditional Access lets you set up location-based access rules using Named Locations, which can specify certain countries, regions, or IP address ranges. If you create a policy to allow access to Power BI or Fabric workloads only from Canada, users trying to sign in from outside Canada will be denied access.For more details, refer to the official documentation: What is Conditional Access in Microsoft Entra ID? - Microsoft Entra ID | Microsoft Learn
Network in Conditional Access policy - Microsoft Entra ID | Microsoft Learn
Additionally, for enhanced network-level security, you can configure workspace-level private links in Microsoft Fabric. This setup ensures that access to a Fabric workspace is only possible through your organization’s private network. While private links do not enforce geographic restrictions directly, they help ensure that only users connected to your trusted network can access the workspace. This can be used in combination with Conditional Access for layered security. For setup guidance, refer to: Set up and use workspace-level private links - Microsoft Fabric | Microsoft Learn
Hope this helps. Please feel free to rech out for any further questions.
Thank you .
Hi sba_ur ,
Thank you for reaching out to the Microsoft fabric community forum and thank you BTm for your resposne.
To clarify you when a Power BI report is configured in DirectQuery mode and connected via a Virtual Network (VNet) data gateway, the data is not imported into Power BI. Instead, queries are executed live against your SQL Server through the secure VNet gateway connection. This setup is defined in the PBIX file during report development. For more details: On-premises data gateway in-depth - Power BI | Microsoft Learn
Power BI itself does not have a built-in setting to enforce VPN usage before loading reports. However, you can achieve this requirement through network and identity-level controls:
You can configure workspace-level private links in Microsoft Fabric to restrict access to Power BI workspaces via Azure Private Link. This ensures users must be connected to your private network (e.g., via Azure VPN or ExpressRoute) to access the workspace.
For your reference : Set up and use workspace-level private links - Microsoft Fabric | Microsoft Learn
Apply firewall rules on your SQL Server to allow traffic only from VPN or VNet IP ranges, ensuring that DirectQuery connections are only possible from secure network paths.
Hope this helps. Please feel free to rech out for any further questions.
Thank you .
sba_urHi Anonymous, thank you for this explanation.
I have another question: is there a way to enforce strict access for reports in a workspace to be accessed from a geographic location (example, Canada only)? If so, how?
Thanks!
Hi sba_ur ,
Thank you for your follow-up question. Although Power BI and Microsoft Fabric do not provide a native workspace-level option to limit access by geographic location, you can achieve this by implementing Microsoft Entra ID (formerly Azure Active Directory) Conditional Access policies.
Conditional Access lets you set up location-based access rules using Named Locations, which can specify certain countries, regions, or IP address ranges. If you create a policy to allow access to Power BI or Fabric workloads only from Canada, users trying to sign in from outside Canada will be denied access.For more details, refer to the official documentation: What is Conditional Access in Microsoft Entra ID? - Microsoft Entra ID | Microsoft Learn
Network in Conditional Access policy - Microsoft Entra ID | Microsoft Learn
Additionally, for enhanced network-level security, you can configure workspace-level private links in Microsoft Fabric. This setup ensures that access to a Fabric workspace is only possible through your organization’s private network. While private links do not enforce geographic restrictions directly, they help ensure that only users connected to your trusted network can access the workspace. This can be used in combination with Conditional Access for layered security. For setup guidance, refer to: Set up and use workspace-level private links - Microsoft Fabric | Microsoft Learn
Hope this helps. Please feel free to rech out for any further questions.
Thank you .