Passing individual login credentials to 3rd party data provides (i.e. SalesForce)

[moni_dd]

Hi There,

We are in a corporate setup where all users are using a single sign-on to the company PowerBI gateway with their domain accounts. That works fine for all internal data sources.

We also work with SalesForce. Security/data-visibility are already setup per user account in SalesForce.

There is a data-visibility issue because PowerBI retains the login credentials used to connect to SalesForce at the time of development. These are usually developer-level accounts that open up lots of data.

Because of that SalesForce is not able to apply its own access rules when users begin using the report, .

Obviously, it is not feasible to request PowerBI to force a SalesForce login every time a report is touched. The negative side-effects are too many to discuss here.

True - PowerBI does offer row-level security, yet using it would mean to begin maintaining access to SalesForce in two places.

Even if SalesForce offers a single sign-on solution, how will this help if the SalesForce PowerBI connector retains the access rights used at the time the report was developed.

So wondering how others using SalesForce (or similar) have solved this issue.

Many thanks!

[v-yuezhe-msft · Accepted solution]

@moni_dd,

If each user directly retrieves data by connecting to Salesforce content pack using his/her own Salesforce account, the user will pull in data to which he has access to in Power BI Service. However, if you set up Salesforce reports using your own Salesforce credential in Power BI, and share the reports to other users, you will need to use Row Level Security(RLS) to restrict data access for these users in Power BI.

In your scenario, you can consider to create data models and reports in Power BI Desktop using your own Salesforce credential, then create a Power BI template(.pbit) and distribute the PBIT file among your users. Users can use the .pbit to instantiate new Power BI Reports by entering their own credential.

Regards,
Lydia Zhang

[v-yuezhe-msft · Accepted solution]

@moni_dd,

If each user directly retrieves data by connecting to Salesforce content pack using his/her own Salesforce account, the user will pull in data to which he has access to in Power BI Service. However, if you set up Salesforce reports using your own Salesforce credential in Power BI, and share the reports to other users, you will need to use Row Level Security(RLS) to restrict data access for these users in Power BI.

In your scenario, you can consider to create data models and reports in Power BI Desktop using your own Salesforce credential, then create a Power BI template(.pbit) and distribute the PBIT file among your users. Users can use the .pbit to instantiate new Power BI Reports by entering their own credential.

Regards,
Lydia Zhang

[moni_dd]

Hi Lydia,

Quick question just to clarify some details.

I went though the motions but got some questions.

How to you distribute a PowerBI template?

You create a SalesForce linked report on your own PC using Power BI Desctop. Then Save-As PBIT. Then:

Publish to MyWorkspace and then share from there somehow

or

You share the actual PBIT file with the users. Then they open this file from their own Power BI Desktop and publish to their personal MyWorkspace (I guess at some point they will be asked for credentials, probably by the Power BI Desktop app upon opening).

Many thanks!

[v-yuezhe-msft · Accepted solution]

@moni_dd,

You share the actual PBIT file with the users. Then they open this file from their own Power BI Desktop and publish to their personal MyWorkspace.

Regards,
Lydia

[moni_dd]

Thanks Lydia!

Will add here some more info once I figure out the how-to details.