PowerBI RS security issue: How to avoid direct access to Report Server URL through the web browser ?

[Takasatsu]

Hi!

We have a serious security issue regarding Power BI Report Server.

We depolyed a power bi report server report URL on a web portal but the URL is easy to catch after inspection on the portal and a user can have access to data of all other customers.

So we would like to avoid direct access to the URL through the web browser.

Authentication mode on Power BI Report Server: SSO (SAML).
Data loading mode: Import.

Has anyone come across this requirement before? Any thoughts or suggested solutions would be greatly appreciated.

Thanks!

[lukiz84]

And the underlying data source? SSAS Tabular?

[Takasatsu]

Hi @lukiz84 

We are using excel files as data source and the data loading mode is Import.

[lukiz84]

Can you clarify the problem? Don't you use RLS?

BR

[Takasatsu]

Hi @lukiz84 

I would like to specify that we are using SSO (SAML) authentication mode on Power BI Report Server to avoid double authentication in the web portal, and with this mode we can not use RLS. What we are doing to manage users access to filtered data is adding filters in the Report Server URL.

The problem is that those filters are not hidden and could be modified or deleted from users after URL catching.

With best regards.