using Publish to public web

[GMkk]

Hi, currently our organization is trying to show the reports to public, without any sensitive data , but as a power bi developer i'm little bit worried wether is it safe to publish to public website and what are the best practices if i have to publish to public website.
does anyone can attack the underlying datasources ? or do i need to have a seperate datasource and analysis services just for this report.
Please let me know the best practices to publish a report to public website
Thank you

[v-zhengdxu-msft · Accepted solution]

Hi @GMkk 

Given that you're connecting to Analysis Services, creating a new tabular model with just the necessary data on a different server is indeed a good approach. This allows you to maintain a clear separation between your internal, sensitive data and the data you wish to share publicly. It also provides an added layer of security, as any potential vulnerabilities or attacks would be limited to the public-facing dataset and not your main data warehouse or Analysis Services.

For more insights on separating your data model from your reports for public sharing, you might find the guidance on Report separate from model helpful.

In summary, while Publish to web is a powerful feature for sharing insights broadly, it's crucial to approach it with caution, ensuring that only non-sensitive data is made public. Creating a separate, sanitized dataset for public reports is a best practice that can help mitigate risks.

If you have any more questions or need further assistance, feel free to ask.

Best Regards

Zhengdong Xu
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[GMkk]

@AlexisOlson  Thank you for your reply, at the moment I'm connecting power bi to analysis service , so does that mean , is it better if i create a new Tab model with just limited data on differnt server and publish that report to web ? 

[AlexisOlson]

If you use Publish to Web, anyone with an internet connection can view whatever you published, so you obviously should not include anything in that report that you don't want publicly visible to the entire world. This makes it a fairly limited option for most businesses.

Best practice suggestion: Don't connect the public report to any data source that contains data that shouldn't be public. Filter, mask, and/or aggregate the data as needed before loading it into the semantic model underlying your public report, so it isn't possible to reveal something sensitive, even by accident, when building the report.