Restrict 'Publish to Web' Functionality?

[olimilo]

So currently I'm publishing my reports as live pages through the Power BI web application, but I would like to know if ever I were to publish the report to the web (without embedding it to any webpage) and sending the link to the report only to people I want to send it to, will the report be accessible in any other way (ie: be looked up with a search engine, etc.)? Or is the report only accessible to people whom I sent the links to?

Also, are there any privacy settings I need to set up first prior to publishing a report to the web?

[Seth_C_Bauer]

@olimilo First, see and read this. Note the giant warning right at the top.

"

Warning:

When you use Publish to web, the report or visual you publish can be viewed by anyone on the Internet. There is no authentication used when viewing these reports. Only use Publish to web with reports and data that the anyone on the Internet (unauthenticated members of the public) should be able to see. Before publishing this report, ensure you have the right to share the data and visualizations publicly. Do not publish confidential or proprietary information. If in doubt, check your organization's policies before publishing.

"

Secondarily, because you are essentially agreeing to expose your data to the internet (everyone), you are inherintly agreeing to the fact that there is no privacy. So, no there are no additional settings.

If you have company data, you need to embed, or use one of the secure sharing methods at your disposal.

[Anonymous]

@Seth_C_Bauer -  Came across this thread and was hoping you could clarify something for me, please.

I've started to trial Power BI and have created a dashboard that I wish to share with members of my organisation.  I've used the publish to web and have used the html code to embed the dashboard into a secure webpage on our intranet. Only members of the organisation can access this page.

Because, i've used Publish to Web, does this still mean someone from the general public can have find and access the dashboard? Even if i'm not using the url link and it's on a secure webpage?

I've used non-sensitive data as a trial run just in case.

I appreciate any clarification.

[Seth_C_Bauer]

@Anonymous "Publish to Web" as @klaus_martinez mentions below is not secure. By default, the link itself is discoverable. It does not matter that you embedded it behind a more secure access point, the link itself is open. Without going into detail, just assume the data is seen. Do not use this method unless you have public data.

[klaus_martinez]

Hi @Eno1978, 

I did a similar thing as you. I embedded the URL to an iframe on an intranet site we have, only accessible internally. However, that embeded URL is accessible via a public network. Our security group defined it as a compromising link and not to use it. I'm not sure how it could the link can be found randomly, unless sniffing programs could find access.  

[olimilo]

Hi @Seth_C_Bauer! Thank you for the link. That is what I've seen in the confirmation box when publishing the report to the web. Is there any other secure way for me to share the report (bar sending the file itself) to other people aside from turning them into live pages in a dashboard?

[Seth_C_Bauer · Accepted solution]

@olimilo There are several options but they require embedding the report into an application.

If this is for external customers, and you have an outward facing applicatoin you can use Power BI Embedded

For internal purposes, you can use the Developer tools to embed or there was a new release that makes embedding in SharePoint really straightforward.

[olimilo]

Thank you! I might just go and embed the reports in Sharepoint. 🙂

[klaus_martinez]

I'm kind of stuck here. I tried to follow the path to embed it to sharepoint. When ever I tried to share this to users with read-only permissions, it asks them to install PowerBI Pro. I will be adminstering the report and I just to need to have read-only access to a large orginization that needs to see this report. I am really trying to avoid having to purchase licesense to read a report. 

Best regards