Forum Discussion
Question about Query activity and security issue with Datasets with Execute Query REST API
Would a user (accidentally) be able to use this process to circumvent the procedures to share protected internal use only data with external email addresses when running a query against a Power BI dataset?No, but they can - accidentally, of course - download the data (or make a screenshot) and send an email to the external contact. Nothing you can prevent technically - this needs to be covered by SBC (standard of business conduct) rules.
I assume I'm going to see "Analyzed by External application" as the query activity for these Power Automate flows the user has for this REST API, is this correct?No, that is separate. MDX queries ("Analyze in Excel") are audited different than DAX queries, and different than XMLA queries.
The data extraction limits per call are quite murky. A ballpark number is 1 million data points (rows times columns) for DAX - but that is only a guidance.
Not sure where your 120 requests per minute limit comes from? Not aware of such a thing. Are you on a P1/F64 ?
There's a limit of 120 query requests per minute per user, regardless of the dataset that's queried.That's a bit of a fluff - I don't think it is related.
You use the Premium Capacity metrics app to gauge how healty your capacity is. For reference - we have P3 capacities with well over 100K queries per minute doing just fine.
Hi JessieF
Regarding the security concerns with using the Execute Queries REST API in an environment with strict external data sharing policies, the API itself does not inherently bypass your established security measures. However, if not properly managed, there could be potential for misuse. For instance, if a user with malicious intent has access to both the REST API and the ability to impersonate another user, they might execute queries that they should not have access to. It's crucial to have robust monitoring and auditing in place to ensure that all API usage is legitimate and compliant with your security policies.
In terms of activity for the capacity, you are correct that you would likely see "Analyzed by External application" for the query activity from Power Automate flows using the REST API. The REST API does have limits in place, such as the 120 query requests per minute, to manage the load on the system. The way the API handles large datasets is similar to Power Query in that it will process the entire dataset before applying any filters. This means that if your dataset is very large, it could indeed have a significant impact on compute resources. The row limit is for the returned results, not the dataset size, so large tables can be queried as long as the result set is within the limit.
Best Regards,
Jayleny
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.