Hi All, This has me a little confused and would love some feedback please.
GOAL: Build a PBIX file which can be filtered for a specific customer and then shared with the customer via a link and will be limited to just their data. Think of a marketing campaign that you want to filter for each customer and them give them access to only their campaign.
OPTIONS:
RLS: This would not work with publish to web and the end customer would require a power BI licence. I would like to make it as simple for the end user and i feel this has a number of pitfalls and maintenance.
Save as a PDF file. This is a last resort as you lose any interactive nature. Note MS is working on interactive reports in Power point.
Publish to web. This is the preferred option. We all know the warnings on the can re security with publish to web. Here is what i would like to confirm please.
a) If the model includes underlying data e.g customer email addresses but this is not visable in the final link, is the underlying data still safe?
b) If you created a filter which the user was not able to change, is the underlying data safe.
The solution we have used in my company works well for a limited number (less than a dozen) customers who need a PowerBi report. We actually maintain their PowerBi license instead of having them acquire it (most are not the type who will get the licensing on their own).
The report has been filtered down in the creation steps, as each report is unique to the customer (not just filtered to their data, but actually designed differently according to their need). And customers are not given access to the underlying data in any form.
For a selection of additional customers, who really are satisfied with a monthly snapshot, we have reports that their sales manager has access to and the PDF is emailed to the sales manager who can then forward to the customer.
Regarding publish to web, one part that I am still and have always been confused about is the following. Lets say in a model there is a table with sensitive data but the report did not show that data in any of the visuals. When the report is published to the web, whilst the data on the report is not secure and can be viewed by anyone, is the data within the sensitive table still secure?
In my PERSONAL opinion, I would not include anything in the model that is sensitive. I tend to be very cautious with sensitive data - I’d rather have a second model on the service than risk leaking anything that could jeopardize my job.
From Adam Saxton’s video below, he shows that your column headers are viewable to someone willing to do the digging. He suggests that the model cannot be explored, but this was as of 2020 - not sure if that has changed.
And here are a couple of articles that talk more in-depth about the topic:
Hello @Hitman, good to see that you are having progress with your inquiry. Did the response from @Heather help you solve your inquiry? If not, how far did you get and what kind of help you need further? If yes, kindly mark as solution the answer that solved your query.
