Embedding with Multi-Tenant data warehouse security concerns

[trevorgermain]

We connect our Power BI reports to a mult-tenant data warehouse, and embed it in a Saas application. The current architecture proposed for the Power BI Service is to:

• Create a "master" user in the O365 tenant
• Create an "app workspace" in the "master" user workspace
• Create an Azure AD app registration
• Connect to the Power BI Service via the REST interface, as the "master" user

A major security concern we have is that if the "master" user's username and password were compromised, a malicious user would have access to all data for all of our customers by simply logging into the Power BI Service and looking at the reports.

1. Is there a way to enable multi-factor authentication for the "master" application, except from the Azure App Service hosting the application?
2. Are there any white papers / guidance on handling multi-tenant data warehouse scenarios, or alternative architectures we should look at?

[v-jiascu-msft]

Hi @trevorgermain,

1. There is multi-factor authentication indeed. You can active it for use "master". Could you please tell me if this could work?

Reference: multi-factor-authentication, multi-factor-authentication-how-it-works, multi-factor-authentication-get-started-cloud

2. What data warehouse it is? About the security of Power BI, please reference here and download the white paper: powerbi-admin-power-bi-security/

Best Regards!

Dale

[trevorgermain]

1. The Multi Factor Authentication may work for me. I was attempting to use the conditional access feature in the Azure Portal, but wan't having much luck getting it to work. This MFA feature seems to work ok. I can restrict portal log in to the service, but programmatic access via ADAL still works.

2. The data warehouse is an On Premise SQL database that we will access via the data gateway.

[v-jiascu-msft]

Hi @trevorgermain,

1. Programmatic access restriction might influence the normal access. I think. Maybe this could help: powerbi-admin-auditing. 

2. About Data Gateway security. Please reference:

powerbi-admin-power-bi-security (The link of the whitebook is in the first paragraph.)

powerbi-gateway-onprem-indepth

Best Regards!

Dale

[trevorgermain]

The following links all show that using Resource Owner Password flow is a bad idea. In fact, the latest version of the ADAL library for .Net Core has removed the UsernamePasswordCredential entirely.

https://github.com/Microsoft/PowerBI-CSharp/issues/30

https://github.com/Microsoft/PowerBI-CSharp/issues/95

https://github.com/AzureAD/azure-activedirectory-library-for-dotnet/issues/482

http://stackoverflow.com/a/29110987

http://stackoverflow.com/a/28597758

http://stackoverflow.com/a/26795582

http://stackoverflow.com/a/39250380

I can only assume that the idea of application permissions will be coming to the Power BI service in the very near future, or the team has completely dropped the ball on the embedding security story.

When can developers expect a proper embedding authentication scenario?