Power BI Embedded semantic model

[skygold16]

Hi everyone,

We are publishing Power BI report to the public interface and hence we are considering to go with power bi embedded. However, we have some concerns regarding the import of granular data into the dashboard. Even though the visuals will display aggregated and grouped data. The dashboard will be made publicly accessible, and authentication will be handled via a service principal account, meaning users won’t need to provide credentials. With this setup, I would like to know if there’s any way for end users to access the granular dataset or access the semantic model in anyways like XMLA? Of cournse, we want to avoid any risk that user can access to the granular data level.

Regards,

[v-pagayam-msft]

Hi @skygold16 ,
We wanted to follow up since we haven't heard back from you regarding our last response. We hope your issue has been resolved.If our answer resolved your query, please mark it as "Accept as Solution" and select "Yes" if it was helpful.If you need any further assistance, feel free to reach out.

Thank you for being a valued member of the Microsoft Fabric Community Forum!

[v-pagayam-msft]

Hi @skygold16 ,
I wanted to check in on your situation regarding the issue. Have you resolved it? If you have, please consider marking the reply that helped you as Accept as solution or sharing your solution. It would be greatly appreciated by others in the community who may have the same question.

Thank you for being a valued member of the Microsoft Fabric Community Forum!

[skygold16]

Thanks Akash, 

The query is more around if I have a semantic model in embedded, do I have to worry about anyone can access the semantic dataset in anyway? 

[Akash_Varuna]

Hi @skygold16 If the semantic model is properly secured, you don’t need to worry about end users accessing the underlying dataset in Power BI Embedded.So for answering your case No, users cannot directly access the semantic dataset in Power BI Embedded if security is configured properly
If this post helped please do give a kudos and accept this as a solution
Thanks In Advance

[skygold16]

Thanks @Akash_Varuna @v-pagayam-msft. 

I do not need RLS in the model. This report is going to be open for Public consumption. Report will be showing data at the aggregated level however I want to make sure that there is not way anyone can access underlying data that is at non aggregated level. 

Also, when you say securing your model properly, what do you refer to? 

[v-pagayam-msft]

Hi @skygold16 ,
Thank you for the repsonse.

As @Akash_Varuna mentioned earlier, Power BI Embedded does not allow direct access to the users if the below are properly secured.

• Restrict data access based on user roles.
• Keep XMLA endpoints disabled
• Limit service principal permissions
• Import only aggregated data
  
  

Hope this helps.If so, please consider accepting it as accept as solution.

[v-pagayam-msft]

Hi @skygold16 ,
Thank you @Akash_Varuna for the accurate response.

If someone queries the data directly, RLS ensures they can only see what their role permits, effectively protecting granular data from unauthorized access.

If this post helps, please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thank you for being a valued member of the Microsoft Fabric Community Forum!

[v-pagayam-msft]

Hi @skygold16 ,
Thank you @Akash_Varuna for the accurate response.

If someone queries the data directly, RLS ensures they can only see what their role permits, effectively protecting granular data from unauthorized access.

If this post helps, please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.
Thank you for being a valued member of the Microsoft Fabric Community Forum!

[Akash_Varuna · Accepted solution]

Hi @skygold16 You could include Rls and other things please check these out 

• Disable XMLA Endpoint: Ensure the XMLA endpoint is not enabled for external users.
• Row-Level Security (RLS): Apply RLS to restrict data access based on user roles.
• Aggregate Data Before Import: Only include aggregated or summarized data in the report.
• Service Principal Permissions: Limit the service principal to required access only.
  If this post helped please do give a kudos and accept this as a solution 
  Thanks In Advance