Data Gateway connection - who needs to have access?

[Johann_32]

Hello,

we have the following constellation:

Dataflows are created by IT and consumed by Power BI users. These dataflows are connected to a on-premise data gateway.

Now the question is:
We currently only added the creators of the dataflow to be allowed using the certain gateway data sources in the "Manage Gateway" section. The Power BI user that will later on consume the dataflow is not added there to have access in the data gateway.

Still, I think the user can build a dataset upon the dataflow (which has a certain refresh schedule plan) without having access to the data gateway connection, right?

Or is it really necessary to also add every user of the dataflows to the gateway also?

Thank you

best wishes

Johann

[Johann_32]

Hello again,

now I got it, thanks a lot. To set the credentials is not a big deal at all, I was just wondering if we were doing something wrong.

What would have been a problem is, that we have to give all our Dataflow-consumers access in the Data Gateway connection. This we want to avoid because it is a lot of maintenance work.

But it seems now it will work without doing that 🙂

Best wishes,

Johann

[Johann_32]

Hello!  

thanks for the quick response. 

I tried around a little bit, and it seems that indeed it is not necessary to put user that is just "consuming" a dataflow in the datasource of the gateway to be authorized,

Instead, when a user consumes a dataflow that he did not create, he can of course upload a new dataset that he wants and then, if he clicks on "Refresh now" in his workspace, there is an error message.

It says that the user has to store credentials there and he can choose from these fields,

Then click on "Sign in" and it works.

It doesn't make much sense why the user has to do this in the PBI service for me.. can somebody explain me what is happening here? 

My assumption was, that if the user consumes a Dataflow, that when he uploads a dataset that he created on this Dataflow, he can just click refresh without any credential input (as the credentials are already stored in the dataflow by another person and the user is just re-using it).

Maybe it is easier if I also upload the lineage..

Thanks a lot!

Best Regards,

Johann

[ibarrau · Accepted solution]

Ok, it's good tha tyou now know how to configure all. I know it feels silly to set the credentials in Service but it's not. For security reasons when you publish your PBI Desktop to Service the credentials won' travel with the dataset+report. The encoded credentials are stored in the Desktop PC and not in the file. The file without credentials is published to service. That's why you need to configure them in order to refresh, because dataset doesn't know about that. The same behaviour happen with gateway, but we don't realize all the things we configure with it. When the source is cloud we don't need one, but that doesn't mean we don't need to configure anything. If a user connects Dataflow to create their own reports, then after publish they have to help the Service engine setting credentials to refresh. Each user building their own stuff means each one has to configure that.

I hope that make sense.

[ibarrau]

Hi! it's like you are thinking. The users won't need Gateway permission because the conection between the Dataset created in the report against DataFlow is a cloud source connected directly. You can just add credentials in the dataset settings and schedule refresh.

I hope that make sense.