Power BI security levels

[Viktorija07]

In a past few weeks I have been learning about Power BI Security, and now I am so confused.

We have Azure security with many informations: https://learn.microsoft.com/en-us/security/benchmark/azure/baselines/power-bi-security-baseline

Then we have the security in Power BI:
Row-level security and object- level security which I can unserstand (I've watched some Youtube detailed courses about those).

But do we have some other securities, and if we do can someone explain it a little bit more because I am confused on how many layers of security do we have? Am I missing some security component?

Please don't share Microsoft Learning page because it doesn't help me a lot, thank you.

[Brunner_BI · Accepted solution]

I can explain some basics regarding Power BI.

All local Power BI files are secured on those clients obviously.

When you upload a file to the Power BI Service (app.powerbi.com) - the reports and semantic models will live in a workspace. A workspace is like a folder where you can apply permissions to access.

You can also build apps (mostly used for distributing reports with a big audience) or even share reports and models individually (without granting workspace level permission).

All of the mentioned above I would call security on an artifact level (either you have access or you dont)

Then we also have more granular security e.g. row-level security.

Even though 100 people have access to a report, app or a model, they might not be allowed to see all data. This is where we can apply RLS (row-level security).

You can build these RLS roles in Power BI Desktop and then assign users or Entra groups to these roles. 

E.g. Region = "West" so that some people only see data for this region.

Object-level security is when you want to hide one KPI e.g. inside a visual - it is not used as much as RLS.

Let me know if that helps you understand a little better how it works in Power BI.

[Viktorija07]

It helps me understand it better.

When you said: "You can also build apps (mostly used for distributing reports with a big audience)" you mean PowerApps app?

User needs to have Power BI license to see workspace/reports/models if I shared those with them?

Do you know if I use something in Power BI that is from ERP (Dynamics 365 F&O), does the user need license for both Power BI and ERP? Can they have only Power BI license to see workspace, models and reports?

[Brunner_BI]

By apps I mean an app inside Power BI which is one or a collection of reports.

You can see it on the left in the main navigation when you are in the Power BI Service.

Every user who wants to consume or is being shared something needs a license - unless you buy a Premium Capacity which is expensive.

Only if you have Office 365 E5 the Power BI Pro license is included.

If a user has no license they can only see their "My workspace"