Forum Discussion
Power BI & SharePoint – Securing Sensitive Data
Hi imik,
Thank you for reaching out to the Microsoft Fabric Community.
Your requirement is unique, and currently, Power BI does not offer a built-in feature that directly prevents Power BI Admins from accessing datasets. However, if this is a critical feature for your organization, I recommend submitting it to the Microsoft fabric ideas: New Idea - Microsoft Fabric CommunityIf the idea gains enough upvotes, Microsoft may consider implementing it in a future update. Many Power BI and Fabric features have been introduced based on community feedback.
If this helps, kindly Accept it as a solution and give a "Kudos" so other members can find it more easily.Thank you.
Put sensitive semantic models and reports in a designated workspace and restrict the access there. Power BI admins don't have access to all workspaces by default, they have to add themselves to the permissions for a workspace to access it, which is logged in the audit logs as an activity - it provides traceability.
It sounds like perhaps you have more Power BI administrators than you should if all your colleagues have the role, though. Consider making people owners of individual workspaces instead of administrators of the entire service?
What many IT teams do is have separate accounts for their administrator roles, so that they only log into the accounts when they need to do administrator activity, then use normal accounts for day to day work.
Hi christinepayton,
Thank you for your insights! As I mentioned in my previous reply, our goal is to make sure that nobody has the option to bypass access restrictions. We have already minimized the number of Power BI service admins, but restricting access to a specific workspace is not a viable solution in our case.
While we could monitor admin activity using ActivityEvents logs, admins occasionally need to access workspaces for maintenance purposes. Ideally, we are looking for a fully independent solution that cannot be bypassed. Simply put, security should not rely on human decisions—it should be enforced technically, making unauthorized access impossible.
My perspective is influenced by my experience with OLAP cubes in Power BI service. In my previous company, we used SQL Server Analysis Services (SSAS) database connector. Even if users had access to a Power BI workspace, they couldn’t see any data without explicit permissions to the OLAP cube. Downloading the report to Power BI Desktop didn’t help either—without the necessary OLAP cube permissions, users couldn’t even open the report. This security mechanism was absolute and couldn’t be bypassed, ensuring full control for the data owners. There was no way to create exceptions, no room for human error, and no possible workaround on the PBIS side.
One theoretical approach we discussed internally is what we call "Active Encryption." The idea is that data would be sent to Power BI in an encrypted form and only decrypted on the user’s end if they have the necessary permissions. Essentially, this would be a combination of RLS and encryption, but it would require implementation outside of Power BI service.
That said, I still believe we are not the only ones facing this challenge, and there must be an elegant, built-in Microsoft solution for it.
Best regards,
imik
