Forum Discussion
How to limit a Power BI report built from Azure SQL database to be published to personal workspace
Hi Clara_HCN ,
Thanks for explaining your situation more clearly. Given that you have multiple Azure SQL environments Development, Test, Acceptance, and Production and wish to ensure that reports using Production Azure SQL are only published to shared workspaces, while also managing publishing permissions, you can achieve this with a mix of governance and security measures.
I recommend creating dedicated Power BI workspaces for each environment and restricting publishing rights in the Production workspace to selected users. This prevents unauthorized publishing of Production SQL reports to public workspaces. Implementing a naming convention for connections such as including Prod or Test in the server name will help with tracking.
Additionally, Microsoft Purview’s DLP policies can detect and alert you to any attempts to publish Production SQL reports to the wrong workspace. Enabling Power BI audit logs will provide oversight on who is publishing and to which environment. Disabling personal workspace publishing via the Admin Portal ensures all reports are managed through approved workspaces.
Assign appropriate roles through security groups, such as contributor for developers and admin for reviewers, and consider a manual review process for reports built on Production SQL before final publishing. While Power BI does not offer a direct setting to block publishing by data source, these steps provide effective control and visibility. Please let me know if you need assistance with DLP or security role configuration.
Thank you,
Tejaswi.
Hi v-tejrama ,thanks for your answer. But if we take the steps recommended by you, will it reject all reports to be published in personal workspace?
Hi Clara_HCN ,
Thanks for coming back,
Yes, if you go ahead and disable publishing to personal workspaces in the Power BI Admin Portal, it will block all reports from being published there, no matter what data source they’re using.
So it's kind of an all-or-nothing switch. Power BI doesn't let you block just Azure SQL reports, once you turn that setting off, no one will be able to publish anything to their personal workspace unless they’ve been specifically allowed.
That said, you can make it a bit more flexible by using security groups. For example, you could allow certain users (like developers or trusted teams) to keep publishing to personal workspaces, while restricting everyone else.
Thank you.
Hi Clara_HCN ,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.
Thank you.
Thanks v-tejrama . In my case,
1. We have different environments for Azure SQL(Development-Test-Acceptance-Production).
2. We want report builders to publish reports to public workspaces if they build reports from production Azure SQL.
3. But we don't want report builders to create and publish reports to public workspace without control.
Do you have any good idea on how to achieve it? Thanks.
Hi Clara_HCN ,
Thanks for explaining your situation more clearly. Given that you have multiple Azure SQL environments Development, Test, Acceptance, and Production and wish to ensure that reports using Production Azure SQL are only published to shared workspaces, while also managing publishing permissions, you can achieve this with a mix of governance and security measures.
I recommend creating dedicated Power BI workspaces for each environment and restricting publishing rights in the Production workspace to selected users. This prevents unauthorized publishing of Production SQL reports to public workspaces. Implementing a naming convention for connections such as including Prod or Test in the server name will help with tracking.
Additionally, Microsoft Purview’s DLP policies can detect and alert you to any attempts to publish Production SQL reports to the wrong workspace. Enabling Power BI audit logs will provide oversight on who is publishing and to which environment. Disabling personal workspace publishing via the Admin Portal ensures all reports are managed through approved workspaces.
Assign appropriate roles through security groups, such as contributor for developers and admin for reviewers, and consider a manual review process for reports built on Production SQL before final publishing. While Power BI does not offer a direct setting to block publishing by data source, these steps provide effective control and visibility. Please let me know if you need assistance with DLP or security role configuration.
Thank you,
Tejaswi.