How can we improve Power BI?

Prevent user (service-side) from entering Edit-mode in Embedded App Owns Data scenario

Currently there is no option in Power BI Embedded API´s or Power BI Service settings to disable a report from being loaded into ‘Edit’-mode by using for instance a Javascript debugger in a web browser, in an app-owns-data Power BI embedded solution. Setting the ViewMode property in Javascript can easily be overridden in any client-side debugger tool. Once an end-user of a website has entered the report in edit mode, the imported data model (i.e. table structure) and all it´s underlying actual data, down to a row-level, is fully exposed to the end-user to freely browse.

What would appear to be a fairly common scenario for using an embedded analytics product; Displaying aggregated only information - without the risk of exposing all it´s underlying data rows - to end-users such as for example sales dashboards, aggregated treatment outcome for a clinical trial, and so on, can therefore not safely be performed using Power BI Embedded today (App Owns Data), with the underlying rows as a base, due to this lack of what would appear a rudimentary security feature.

Please implement some form of service/server-side option to disallow end-users from going into Edit-mode simply by changing some Javascript settings in a web browser debugger. E.g. an option in the API, token generation model or Power BI Service. This would allow the visualization of aggregated data to be implemented more securely, where the underlying imported data is sensitive, e.g. for data privacy, security and compliance requirements.

Steps to reproduce:
1. Create an ASP.NET MVC project (App Owns Data scenario) and
display the report on a page. Create the token with access level "view".
2. The code below will open the report in read mode (excerpt):
var config = {
type: 'report',
tokenType: models.TokenType.Embed,
accessToken: accessToken,
embedUrl: embedUrl,
id: embedReportId,
permissions: models.Permissions.Read,
settings: {
filterPaneEnabled: false,
navContentPaneEnabled: true,
localeSettings: {
language: 'en',
formatLocale: 'en'
}
}
};
3. Load the page and display the report which will now open in read mode, as expected.
4. Using a Javascript browser debugger, reload the page and set a breakpoint somewhere after the config object creation.
5. In the Javascript debugger console, type the following lines of code and then continue with code execution:
config.permissions = models.Permission.All;
config.viewMode = models.ViewMode.Edit;
6. The report is now opened in Edit-mode.
7. The end-user can now simply drag a table from Visualizations and display any selection of data from the imported datasets.

11 votes
Sign in
(thinking…)
Sign in with: facebook google
Signed in as (Sign out)

We’ll send you updates on this idea

Anders shared this idea  ·   ·  Flag idea as inappropriate…  ·  Admin →

1 comment

Sign in
(thinking…)
Sign in with: facebook google
Signed in as (Sign out)
Submitting...
  • Anders commented  ·   ·  Flag as inappropriate

    As mentioned in the case above, setting the token accesslevel to View does NOT prevent an end-user from simply using a Javscript/client-side debugger to have the report enter in Edit-mode, exposing the underlying data - which can easily be reproduced using the steps described (unless this there has been some fix/change in the Power BI token handling within the last 1-2 weeks).

    Please do not hesistate to contact if you need further information, as this currently is preventing us from using Power BI Embedded for several customer cases in medical/regulatory fields.

Feedback and Knowledge Base

Ready to get started?

Try new features of Power BI today by signing up and learn more about our powerful suite of apps.