Security - Ability to maintain source security for reports published on BI Sites
The general requirement is that visualizations (Power View, SSRS etc...) must not circumvent existing policies, or introduce yet another set of security policies on top of those already implemented at the source.
- For example, a visualization of sales data needs to reflect the policy that account managers can only read sales data for their region.
- For performance reasons, this is enforced at the source by injecting predicates into the query based on the end users identity. If identities for end users are not passed down the process chain into the data layer, it leaves us little option but to publish individual reports for every region, which results in an explosion of complexity and numbers of reports, or move the whole model to BISM and manage the policy in yet another place (namely the BISM model).
blocking migration to SPO/BI Sites. At least 412 Site Collections with more than 600 Power Views. Impacting Adoption or migration for majority of BPUs - e.g. Finance, LCA, HR, etc
We’ve continued to make progress here, so I wanted to update this thread with our current capabilities for maintaining security on dashboards/reports.
As always, all of this information can be found in our Row-Level Security (RLS)documentation: https://powerbi.microsoft.com/en-us/documentation/powerbi-admin-rls/
> If you have set up RLS in Analysis Services, Power BI will send the signed-in user’s credentials to Analysis Services, and respect the RLS rules set up on the on-premises model.
> Separately, you can set up RLS in Power BI for data sources that you import or connect to via DirectQuery. This process starts in PBI Desktop, where you define roles, and write DAX to constrain what data these roles can see. As part of this process, can you use the UserPrincipalName() DAX function to get the current signed in user’s UPN (e.g. email@example.com). Then, once you publish to service, you can assign users to these roles.
Does the above meet your requirements? Please let us know via comments or e-mail.
Those of you who requested that the identity of the signed in Power BI user be pass through to Azure SQL, SQL DB, DWH, etc.: we hear you – that is under consideration.
Still looking to see if there is a general solution for this without SSAS. This is crucial to implementation and may ultimately be the deal breaker that moves us to another platform.
How do we Implement Row Level Security???
In an Organizational Hierarchy?
Do Power BI Provide any Solution For it.
@marcelo, I can not repro the first issue you reported. Can you please file a ticket at https://support.powerbi.com by clicking on "Contact support" for better assistance? And yes, we are actively working on #2.
Bart vd Bergh commented
Most certainly, passing the identity from power BI web to a backend is a necessity!
1. The security option does not show in portuguese version.
2. We need to be able to upload and updated file from PBI Desktop without having to redo the RLS.
Vincent-Philippe Lauzon commented
Saw it in action, it's exactly what we needed.
I just quickly tested the row-level security and it works great. I will do more testing and provide our feedback. Thank you so much Power BI team !!.
Very much needed feature. Without this you cannot productize metrics. A deal breaker.
Mark C commented
+1 for the ETA Please as this is preventing us from starting a major project and also because I used THREE whole votes :D
This will increase user adoption. Very few people will go through all the steps necessary to create personalized filtered reports/dashboards. We need the ability to distribute corporate reports without 2 pages of instructions on how to personalize them.
Maarten van den Dool commented
to use it for the company we need the possibility of default settings of a filter, depending on the user login, in SSRS we can handle that, but not in power BI
to: JD ... I absolutely agree
To clarify, we don't need a security trimmed view... just a filter that returns the current user's name or UPN.
Any news about this feature?
It would be great to be able to implement the equivalent of RLS for Data sources such as Salesforce.com which would be based on the users login credentials that would check a user ID and only return records that match the user. Currently I have to create separate set of reports for each sales person (24+) and set the filters so that they only see their own data.
The previous solution only works for those who have "SQL Server Analysis Services" + Enterprise Gateway.
I't would be great if we could send dashboards with some filters applied, but not allowing the end user to change those filters.
A lot of companies need this feature before they can apply Power BI as a business tool.
Is there a plan to implement this anytime soon???
Sebastian Garces commented
You can do that with SSAS Tabular model and row-security model. Follow this link to do that https://msdn.microsoft.com/en-us/library/hh479759%28v=sql.120%29.aspx
Basically, I'd like to see a 'Report-Creator' filter. As in, I apply the filter on my end but the Dashboard User cannot change it.
Kristen Martel commented
I would like to ask the Power BI team if there is a current work around for this?
Indeed - I would consider this an ´enterprise´grade feature ... so many things you could do in sales reporting for example: Store / Sales area performance, Sales commission etc.)
Onboarding User commented
Would greatly ease the deployment of reports and dashboards to users assigned to different accounts or geographical area and filter data only relevant to their filed without having to manage separate reports for each user.