Embedding with Multi-Tenant data warehouse security concerns

Question

We connect our Power BI reports to a mult-tenant data warehouse, and embed it in a Saas application. The current architecture proposed for the Power BI Service is to:

Create a "master" user in the O365 tenant
Create an "app workspace" in the "master" user workspace
Create an Azure AD app registration
Connect to the Power BI Service via the REST interface, as the "master" user

A major security concern we have is that if the "master" user's username and password were compromised, a malicious user would have access to all data for all of our customers by simply logging into the Power BI Service and looking at the reports.

Is there a way to enable multi-factor authentication for the "master" application, except from the Azure App Service hosting the application?
Are there any white papers / guidance on handling multi-tenant data warehouse scenarios, or alternative architectures we should look at?

v-jiascu-msft · Answer

Hi&nbsp;trevorgermain,&nbsp;1. There is multi-factor authentication indeed. You can active it for use "master". Could you please tell me if this could work?Reference:&nbsp;multi-factor-authentication,&nbsp;multi-factor-authentication-how-it-works,&nbsp;multi-factor-authentication-get-started-cloud&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;&nbsp;2. What data warehouse it is? About the security of Power BI, please reference here and download the white paper:&nbsp;powerbi-admin-power-bi-security/&nbsp;Best Regards!Dale

trevorgermain · Answer

1. The Multi Factor Authentication may work for me. I was attempting to use the conditional access feature in the Azure Portal, but wan't having much luck getting it to work. This MFA feature seems to work ok. I can restrict portal log in to the service, but programmatic access via ADAL still works.

2. The data warehouse is an On Premise SQL database that we will access via the data gateway.

v-jiascu-msft · Answer

Hi&nbsp;trevorgermain,&nbsp;1. Programmatic access restriction might influence the normal access. I think. Maybe this could help:&nbsp;powerbi-admin-auditing.&nbsp;2. About Data Gateway security. Please reference:powerbi-admin-power-bi-security&nbsp;(The link of the whitebook is in the first paragraph.)powerbi-gateway-onprem-indepth&nbsp;Best Regards!Dale

trevorgermain · Answer

The following links all show that using Resource Owner Password flow is a bad idea. In fact,&nbsp;the latest version of the ADAL library for .Net Core has removed the UsernamePasswordCredential entirely.&nbsp;https://github.com/Microsoft/PowerBI-CSharp/issues/30https://github.com/Microsoft/PowerBI-CSharp/issues/95https://github.com/AzureAD/azure-activedirectory-library-for-dotnet/issues/482http://stackoverflow.com/a/29110987http://stackoverflow.com/a/28597758http://stackoverflow.com/a/26795582http://stackoverflow.com/a/39250380&nbsp;I can only assume that the idea of application permissions will be coming to the Power BI service in the very near future, or the team has completely dropped the ball on the embedding security story.&nbsp;When can developers expect a proper embedding authentication scenario?

Forum Discussion

Embedding with Multi-Tenant data warehouse security concerns

4 Replies

Related content

Multi Tenant Embedded

Multi-tenant workspaces

Multi tenant user control

warehouse vs lakehouse

Warehouse CICD