Microsoft Cloud App

[bally]

Hi All,

We are looking to publish Power BI reports to personal Windows 10 devices of users and we are looking at restricting access.

Similar to conditional access we wish to enforce restrictions:

• Data can be accessed via a browser-only with no ability to download, print, or synch files.
• Users will also be prevented from accessing content through desktop apps
• Have the ability to control whether we allow or block editing of files in the browser
• Users will always be prompted for MFA

So, prompting for MFA is available. However, for example, can I put in restrictions so that if a user exports data or wants to modify data, this can only be done using the online version of Excel? In essence creating a sandbox area away from the local machine.

Microsoft have advised that we can create tenant level restrictions:

https://docs.microsoft.com/en-us/power-bi/service-admin-portal#tenant-settings

but I was hoping to have something a little bit more granular.

One solution that might be viable is using Microsoft Cloud App Security to publish the Power BI site. However, I am not too sure how this would be done.

I am new to Power BI so I apologise for any ignorance of how the environment works, but has anyone dealt with a similar issue or can provide any guidance?

Many thanks in advance!

[v-shex-msft · Accepted solution]

Hi @bally,

>>Data can be accessed via a browser-only with no ability to download, print, or synch files.

You can turn off export data option in admin portal to disable export features, such as download, export data, connect power bi service datasets on power bi desktop side. (notice: print page feature still work on power bi service side)

>>Have the ability to control whether we allow or block editing of files in the browser

You can move these contents to group workspace to use group permission to control which user can edit contents.

Manage your app workspace in Power BI and Office 365

>>Users will also be prevented from accessing content through desktop apps, users will always be prompted for MFA

You can turn on Azure AD device authentication to manage accounts sign on mobile device side with MFA authentications.

What is device management in Azure Active Directory?

Secure and Audit Power BI in Your Organization

>>However, for example, can I put in restrictions so that if a user exports data or wants to modify data, this can only be done using the online version of Excel?

Nope, I don't think you can sue excel online to edit your contents. Current you can only use excel online to edit workbooks list on workbooks tab.(use 'get data' option to upload/import to power bi service side).

Regards,

Xiaoxin Sheng