Forum Discussion
Power BI & SharePoint – Securing Sensitive Data
Hi imik,
Thank you for reaching out to the Microsoft Fabric Community.
Your requirement is unique, and currently, Power BI does not offer a built-in feature that directly prevents Power BI Admins from accessing datasets. However, if this is a critical feature for your organization, I recommend submitting it to the Microsoft fabric ideas: New Idea - Microsoft Fabric CommunityIf the idea gains enough upvotes, Microsoft may consider implementing it in a future update. Many Power BI and Fabric features have been introduced based on community feedback.
If this helps, kindly Accept it as a solution and give a "Kudos" so other members can find it more easily.Thank you.
Hey there!
Since you need Power BI to connect to SharePoint while ensuring that only users with direct SharePoint access can see the data (even restricting Power BI admins), here’s a secure solution:
1. In SharePoint, set strict permissions on your Lists and Files:
Remove access for Power BI Admins if they should not see the data.
Assign specific user/group access only to those who need it.
Ensure that Power BI service accounts do not have blanket access to SharePoint.
2. To ensure Power BI only retrieves data for authorized users, use:
OAuth Authentication → Power BI can connect to SharePoint using the logged-in user’s credentials instead of a shared service account.
Use "Organizational Account" Login in Power BI → When connecting SharePoint Online, ensure that each user logs in with their own credentials.
This ensures only users who can access the data in SharePoint can retrieve it.
3. Since standard RLS doesn’t affect admins, use Dynamic RLS to filter data based on user access.
DAX RLS Rule for SharePoint Users
- Create a User Access Table (from SharePoint List/Active Directory) with:
- UserEmail, AllowedSharePointSite, Permissions
Create a DAX filter in Power BI: User_Access_Filter =
LOOKUPVALUE(
'UserPermissions'[AllowedSharePointSite],
'UserPermissions'[UserEmail], USERPRINCIPALNAME()
) <> BLANK()
Apply this RLS rule to restrict Power BI visuals based on SharePoint permissions.
5. Instead of loading data into a dataset, use Power BI Dataflows:
Configure Dataflow access only for allowed users.
Keep raw data secured in SharePoint, and only expose processed data.
6. To prevent Power BI admins from bypassing RLS, do the following:
Remove "Admin" roles for those who don’t need it.
Use Viewer Role → Ensure users only see reports but cannot download datasets.
Disable "Export Data" to prevent sensitive information leaks.
Hope this helps!
😁😁
Hi freginier,
First of all, thank you very much for your response and effort!
I have gone through all the suggestions, and I’d probably start from the end. The Power BI service admin role is limited to the absolute minimum number of people, so there is no unnecessary overlap. The main issue here is that we need to prevent anyone, including Power BI service admins, from accessing the sensitive SharePoint data.
Given this requirement, any RLS-based approach is not applicable in our case. While it’s true that Power BI service admins do not have direct access to the specific SharePoint file, our concern is that once the data is pulled into Power BI, it might still be accessible.
Dataflows seem like a promising direction, but we are unsure whether this approach would prevent the data from being stored and accessible within the Power BI service. As for Dynamic RLS, it is indeed an interesting idea, but wouldn’t it still be bypassed by someone downloading the dataset and opening it in Power BI desktop?
Best regards,
imik