how to create and share reports with clients using client data

[Anonymous]

My company is considering consuming our clients' data and delivering PBI reports to them.  There will be a strong security boundary between our data / reports and each of our clients' data / reports (as there should be).  There will be multiple clients.  We currently have one O365 / PBI tenant, we share reports internally via apps, and we have a shared capacity licensing model (with all users having Pro licenses, as we have <500 users).

What does an implementation look like for this?  That is, do we need to be in a multi-tenant model?  How do we keep users under each client from viewing data / reports that they shouldn't be seeing?  Is it okay to keep each of the tenants in a shared capacity model (assuming data volumes are low enough)?  How do we transfer all content that we have created for them in our tenant to a tenant of their own (should they want to terminate their contract with us but not lose the content we have created for them)?

[collinq]

Hi @Anonymous ,

From a purely techincal perspective, you could use RLS to keep them all separate.  But, from a lawsuit and best practice I would keep each client's data separate.  You could do this on one single tenant I guess - you would create a separate workspace for each client and only share that workspace with that client.  This model would give you one single tenant and multiple workspaces but even in this case you have to be very careful that you NEVER let the users get to another client's workspace.  And, I am assuming that you are not comingling the the underlying data - each client has their own datasource and dataset.  If you have one single datasource and on single dataset and you are only spearating clients' informaino based on a filter you are asking for trouble.  It will take just one mistake one time by one person at your company to expose data to multiple clients.

I would appreciate Kudos if my response was helpful. I would also appreciate it if you would Mark this As a Solution if it solved the problem. Thanks!

[Anonymous]

@collinq 

Yes, each of our clients' data will all be separate, both at the data storage / DB level and at the presentation / PBI level.  At a minimum, that means that each client would get a separate schema / DB in our data warehouse.

For sharing, can this be done via apps?  Or, does it have to be done with workspaces (or some other means)?

To help prevent administration mistakes, is it best practice to go with multi-tenant?  Or, is that overkill?

[collinq]

Hey @Anonymous ,

Yes, you can share at APP level and not just at workspace level.  Sharing at the APP level is more restrictive and will help with any drill through isues (assuming you do not turn that on).  I am generally cautious about data and the potential for a mistake so it might be overkill to go multi-tenant but that is the safest way.  I am thinking through that even in the most "innocent" way it could happen where a person looks to share or otherwise do something with a report and suddenly they are seeing all the allowed users names/emails that are on the tenant and they see all of the competition sitting there.  That should not happen....but, of course that stuff happens over time.

I would appreciate Kudos if my response was helpful. I would also appreciate it if you would Mark this As a Solution if it solved the problem. Thanks!

[Anonymous]

@collinq 

Does creating more than one O365 tenant result in additional charges?  And, even in a multi-tenant model, is there still a possibility for a given client in one tenant to see / infer who the other clients are in other tenants?

[collinq · Accepted solution]

Hey @Anonymous ,

Each tenant will have its own userids and would have its own cost. 

I would appreciate Kudos if my response was helpful. I would also appreciate it if you would Mark this As a Solution if it solved the problem. Thanks!