Best practice for giving 3rd Party access to data

[Daveed1973]

We have a 3rd party customer who have their own Power BI subscription. As we provide a service to this 3rd party they would like to be able run and create their own KPI reports in Power BI but would need access to our data to be able to do this.

All our data is stored in an Azure SQL database but this also has other customer data in it too.

So I was wondering if anyone had any ideas on the best way forward to allow this customer to access only their own data stored in out database through their own Power BI subscription?

Thanks in advance!

[v-stephen-msft · Accepted solution]

Hi @Daveed1973 ,

I think you might want to distribute Power BI content to external guest users with Azure AD B2B.

There're two ways to invite guest users: Planned invites and Ad hoc invites.

When using the allow external guest users to edit and manage content in the organization feature, the specified guest users get additional access to your organization's Power BI.

Best Regards,

Stephen Tao

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Daveed1973]

Did some research on this yesterday and from what I can see using Azure AD B2B external collaboration may the best option here.

I can set up a Power BI app with all the relevant content and share this with the external 3rd party. This gives them the ability to consume the reports and dashboards within the app but not to create their own content.

To allow them to create their own content you have to enable the "Share content with external users" feature in BI Admin portal. By also allowing the "Allow external guest users to edit and manage content in the organization" feature from within the BI portal and sharing the Power BI workspace with them, they can also create their own content from the datasets they have access to within the workspace.

From what I can see so far, they DO NOT get access to any of the data outside of the dataset that comes from our own database, only the dataset we give them access to.

In this case I created a new workspace and a new set of database views and reports on top of these views specifically for this guest and added only these views to the dataset. What they can see by giving them edit rights is the database name and the sever name but not any of the credentials for connecting to this. If they wanted to access to additional data outside of the dataset within the BI reports then this is something we would have to add for them. 

It's still early days and I am still testing this but it seems it may solve the problem.

[mcolb88]

Hi @Daveed1973 

I am wondering if you can share access to the a workspace containing a DataFlow that pulls only the data you want to share and then they can connect to the DataFlow to pull into thier reports.  The benefit to the data flow over a dataset would be including this as part of what they need. If they consume your dataset, they won't be able to add addtional data sources.

Just a thought, hope this helps.

[collinq]

Hi @Daveed1973 ,

By definition, if you give them access to the database, they will see the other information.  What I would do, is create a view with just their information.  And, to be very secure about it, if you want them to hit SQL, I would actually put that view in it's own database so they can only see their stuff.  Better yet, what I would do is create a massive dataset for them with just their stuff and then give them access to the dataset.  That way, they never even get to the database and you don't have to worry about SQL security.  

I would appreciate Kudos if my response was helpful. I would also appreciate it if you would Mark this As a Solution if it solved the problem. Thanks!