Data Security when using the "publish to Web" option

[BYRON]

Hi Everyone, I am hoping someone can help me!

I want to embed a Report into a Shaepoint Teamsite, and I get this message prior to getting the embed code:

"You are about to create an embed code for this report. Once published, anyone on the Internet will be able to access the report and the data it contains."

If I embed code (via the "Publish to Web" option) into a Sharepoint Teamsite Document/Page and that Teamsite sits behind a major government Firewall and also has user-restricted access, is my data secure? There is absolutely no public internet access to this Teamsite?

Thanx

- Byron

[v-yuezhe-msft]

Hi @BYRON,

When you use “Publish to Web” feature to share a report, everyone who has the link or embed code shown in the following screenshot can access the report, they cannot edit the report, but they can view it with no restriction.



In your sceanrio, to secure the data in some extent, you would need to avoid the issue that the link or embed code is get by others who don't have permission to the Sharepoint Teamsite Document/Page.

Thanks,
Lydia Zhang

[jardaKarlik]

Hello,

is there a way to hide that SHARE button (bottom right corner) which is on embeed powerBI reports?? I think when I can control if some other people can share it further than all is fine. 

People which accessing report embed in page, will not be able to see direct link to the report, and so they will not be able to share it further. 

[hassaansyed]

When you share with someone it asks you if you want to allow the person to share further or not. You can also change this option later on. 

You can access the option by click on share option which will open a window. Then click on the "Access" tab in that window and then three dots ... to change the option.

I am not sure if this only available in the Pro version or available for other users also and it will work with embedded code also or not but with embedded code there is another problem that Microsoft gives warning that they might add it to gallery.

Regards,

Hassaa

[hassaansyed]

When you share with someone it asks you if you want to allow the person to share further or not. You can also change this option later on. 

You can access the option by click on share option which will open a window. Then click on the "Access" tab in that window and then three dots ... to change the option.

I am not sure if this only available in the Pro version or available for other users also.

Regards,

Hassaan

[BYRON]

Hi Lydia, thanks for your reply.

So what you are saying is that if I put the embed code onto a Sharepoint Teamsite which is not accessible by the public then the data is secure (ie the general public can not go onto the internet and get access to my data).

Is that correct?

Regards

- Byron

[v-yuezhe-msft]

Hi @BYRON,

As long as a user gets the link of your shared report using some methods, for example, access Sharepoint Teamsite to get the link, copy the link from someone who has access, he/her will be able to view your report. In other words, without the link of the shared report, general public will not able to view the report.

Thanks,
Lydia Zhang

[BYRON]

Hi Lydia,

This is from the Power BI website: "link":https://powerbi.microsoft.com/en-us/documentation/powerbi-service-publish-to-web/#licensing-and-pric...

"When you create an embed code using Publish to web, the report is made visible to users on the Internet."

"It’s publicly available so you can expect viewers to easily share the report through social media in the future.

"As users view the report, either by opening the direct public URL or viewing it embedded in a web page or blog, Power BI caches the report definition and the results of the queries required to view the report."

My head of network security advises that the embed code actually creates a publically visible page, which is hidden by obscurity but could still be found and accessed by the public.

How can I have an interactive report on my intranet without risking public access to my data?

- Byron

[v-yuezhe-msft]

Hi @BYRON,

I am afraid  that  you are not able to secure your data when using the "Publish to Web" feature, an idea that make the publish to web feature available to be used for private sites has been submitted in the following link, please vote it.

https://ideas.powerbi.com/forums/265200-power-bi-ideas/suggestions/11714058-private-publish-to-web

In your sceanrio, you can consider to use Power BI Embedded to intergrate reports to web applications.

Thanks,
Lydia Zhang

[httpftp123]

Hi @v-yuezhe-msft - based on the current limitations of 'Publish to Web', would the only way to display the dashboard (while keeping it private) to the SharePoint teamsite be using REST APIs to embed the reports/dashboard into an app and surface it through an add-in webpart?

https://powerbi.microsoft.com/en-us/documentation/powerbi-developer-overview-of-power-bi-rest-api/

Thanks in advance!

[httpftp123]

Hi all - will using the REST APIs/SharePoint Add-in be applicable for this scenario?