Forum Discussion
On Premises Gateway Setup
Hi ALL,
Below is the scenario where i would require you guys help ---
AS IS scenario -
We have three different clients for which we have created three different tenants and gateway's have been installed on three different machines so that users of above specified three clients dont see the dashboard or reports across each other. i.e. client 1 would see the report in the workspace 1 and client 2 would see the report in the workspace 2 only.
Note - the three data bases requried for the above three clients are on different instnaces and their domain is also different, so the reason that three different tenants were created and three different gateways for the same.
To be process -
Now our organisation is planning to bring the reporting data base from three different instances to a single common instance i.e. Db1 would have (RPT1, RPT2, RPT3) , but still here the common clause would be that the users shouldnt see the data across clients i.e. client 1 would see the report in the workspace 1 and client 2 would see the report in the workspace 2 only.
Now with this database merger apporach that we are planning to take, is there any better way wherein I can re organise my gateways from 3 to 1. Wherein I would have one gateway connected to a single datasource as we are going to have all the reporting db's on single instance. With the expection that with new approachas well users should not see the data across clients i.e. client 1 would see the report in the workspace 1 and client 2 would see the report in the workspace 2 only.
Kindly request you to suggest a approach.
10 Replies
vishy4271 As you are consolidating everything to a single machine, you can go down to a single gateway. The permissions as you have built them in the workspace appear to be the only place you are ensuring there is no crossover. I would also add in an additional layer of row level security in each model (or report) depending on how you deployed them, to ensure that if there was an error and a user got added to the wrong workspace, the model would restrict the user from seeing any data that is not relevant because they wouldn't be part of the same group (AD) as those in the workspace.
Hi Seth,
Currently we are not planning to have a rls being implemented, that is in our road map but not as of now, so if we want to have a quick solution with not having rls, would having only one gateway suffice. Basically in this organisation they had created three different gateways and three different tenants with a aim that the three different clients would not have a cross over.
I did suggested rls but as said above that is not in scope as of now and they are looking for a quick win. That is the reason , i am thinking atleast having one gateway can we achieve the as is scenario with out breaking any reports or access. I am also basically trying to understand if the solution of having 1 gateway would work. Because having one gateway and then three different data source i.e. Rpt 1, rpt 2 and Rpt 3. And i can add the users of the three different clients in the respective for publishing if needed. Now in power bi web , the plan is to have different workspace itself and add users of respective clients in the workspace or create apps and share with them. Is this approach correct?
Also with one gateway , it would be configured by only one client id which would be in one tenant. would that have a problem for the users of other tenants( because for other clients the tenants are different) being added in the same gateway in different data sources would power BI allow.
There is a question in my mind as well what was the reason for creating three different tenants as there goal was just that there should not be a cross over. But the person who had implemented that has left the organisation. And basically now I am trying to stream line things wrt power BI. Also if you can help me explain was there a actual need to have three different tenants , was that approach correct?
Anonymous
Hi Seth,
Currently we are not planning to have a rls being implemented, that is in our road map but not as of now, so if we want to have a quick solution with not having rls, would having only one gateway suffice. Basically in this organisation they had created three different gateways and three different tenants with a aim that the three different clients would not have a cross over.
I did suggested rls but as said above that is not in scope as of now and they are looking for a quick win. That is the reason , i am thinking atleast having one gateway can we achieve the as is scenario with out breaking any reports or access. I am also basically trying to understand if the solution of having 1 gateway would work. Because having one gateway and then three different data source i.e. Rpt 1, rpt 2 and Rpt 3. And i can add the users of the three different clients in the respective for publishing if needed. Now in power bi web , the plan is to have different workspace itself and add users of respective clients in the workspace or create apps and share with them. Is this approach correct?
Also with one gateway , it would be configured by only one client id which would be in one tenant. would that have a problem for the users of other tenants( because for other clients the tenants are different) being added in the same gateway in different data sources would power BI allow.
There is a question in my mind as well what was the reason for creating three different tenants as there goal was just that there should not be a cross over. But the person who had implemented that has left the organisation. And basically now I am trying to stream line things wrt power BI. Also if you can help me explain was there a actual need to have three different tenants , was that approach correct?
vishy4271 You have a lot of different things going on here.
1) If you are consolidating tenants, how are you planning to have those users sign in? Are they all rolling into the same domain for log in?
2) Gateways don't provide an end users security layer. End users see whatever the report author sees. So if Client B is added to the Client A workspace, or has content shared with them, then Client B would see Client A's data.
3) You could use the filter approach in PQ, but that is not a very secure way either because it is prone to error via a report author or update. You want to ensure your security runs to the level that it can't be comprimised with a simple mistake.
If you are playing fast and loose, a single gateway is sufficient as there is no security there. Filtering the report as henriquesilveir could add a minimal layer of protection. But all it takes is one person to accidently share a report with the wrong person to compromise data.
The seperate tenant setup was likely to silo the different users so that they couldn't accidently share.
RLS is typically not that complex to implement. I would look into this and restrict the datasets so that even if something were shared, if the end user wasn't part of the model, then they would not see the data.
vishy4271 hello Vishy, i hope that you need use a RLS to do this, take a look this article: https://docs.microsoft.com/pt-br/power-bi/service-admin-rls
Using RLS you can create multiple data marts with same dataset.
Currently we are not planning to have a rls being implemented, that is in our road map but not as of now, so if we want to have a quick solution with not having rls, would having only one gateway suffice. Basically in this organisation they had created three different gateways and three different tenants with a aim that the three different clients would not have a cross over.
I did suggested rls but as said above that is not in scope as of now and they are looking for a quick win. That is the reason , i am thinking atleast having one gateway can we achieve the as is scenario with out breaking any reports or access. I am also basically trying to understand if the solution of having 1 gateway would work. Because having one gateway and then three different data source i.e. Rpt 1, rpt 2 and Rpt 3. And i can add the users of the three different clients in the respective for publishing if needed. Now in power bi web , the plan is to have different workspace itself and add users of respective clients in the workspace or create apps and share with them. Is this approach correct?
Also with one gateway , it would be configured by only one client id which would be in one tenant. would that have a problem for the users of other tenants( because for other clients the tenants are different) being added in the same gateway in different data sources would power BI allow.
There is a question in my mind as well what was the reason for creating three different tenants as there goal was just that there should not be a cross over. But the person who had implemented that has left the organisation. And basically now I am trying to stream line things wrt power BI. Also if you can help me explain was there a actual need to have three different tenants , was that approach correct?
vishy4271 you could use 1 gateway for 3 dataset, but you must to configure all datasources.
And you can set different filters for each dataset... i recommend to you set the filter, into .pbix file, but no using Report Filter, use Power Query Editor to filter all of them. create 3 .pbix and publish them.
