Dataset access without DB access?

[itsmebvk]

Hi Experts,

I need your experty and inputs in one of access related issue.

I created a composite model which has Three Fact , Three Dim Tables, Three Agg Fact Tables. 

When it is import mode I can apply RLS on Dataset without granting users DB access as data sits in Powerbi file. But when I use composite model based on visualization, queries may hits DB ( Dirext Query tables) or sometimes it hits Agg Tables imported in Power BI file. In this case if we need to allow the users to access direct query tables do we need to grant  all users (5000+) DB access? 

I can use  service account and configure Dataset using that service account, but if I use service account when user query hits I may loos track of users activity.

Can some one suggest your inputs and share your experience around security?

Thank you.

[v-yetao1-msft · Accepted solution]

Hi @itsmebvk 

You can directly share your dataset with end users without giving them access to the data source .They can access the data from your datasource with Pro licenses or the dataset in Premium capacity with free licenses .

More info about sharing dataset can refer to the link

https://docs.microsoft.com/en-us/power-bi/connect-data/service-datasets-share

I searched in MS but found no introduction about the usage metrics for Rest API . But you can monitor usage metrics for reports and dashboards in the new workspace experience.

For specific introduction, you can refer to the link

https://docs.microsoft.com/en-us/power-bi/collaborate-share/service-modern-usage-metrics

Best Regards

Community Support Team _ Ailsa Tao

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[aj1973]

Hi @itsmebvk 

Implementing RLS to your dataset does not grant access to DB to users anyway of connection, that's why import mode works fine for you. However using DQ mode has some limitations. Please check out this image and see if your dataset hits one of theses limitations

I am guessing the once in yellow could be the cause

[itsmebvk]

@aj1973 @ibarrau 

Thanks for your valuable inputs. 

We already have usage metrics dashboard which captures user activity from usage log. 

Can you please help me with following questions.

Question1: Assume that I have Dataset  with 3 tables which are direct query tables. Without giving users DB access is there any way to grant them to access Dataset ( except import route)? 

Question2: Assume that I have used service account for Dataset configuration, but how Can I track user executed queries from Rest API usgae metrics?

I am really sorry if I ask same question. Thanks.

[aj1973]

I can answer Question 1 : Grant them users access to the wrokspace, Users will need at least Power bi Pro license.

Question : not familiar with it. Sorry

[itsmebvk]

@aj1973  Thanks for your reply. 

Does it means without DB access to users by giving Workspace access, can they create visualizations using datasets ( Direct Query) which are in that workspace?

[aj1973]

Yes, DQ mode doesn't give permission to users to access the DB. Visualizations sends queries to the DB via DQ mode.

[ibarrau]

Hi. I'm not an expert in Direct Query but let's see. First of all the way Power Bi works will ask you for a unique account (it's recommended a service one) that will login from Power Bi Service to the database (directly if it's azure and via gateway if it's local server). That means you don't have to configure anything in the data base for the users.

Regarding the tracking activities of the users it is recommended to get that data from the Power Bi Rest API that has a request to Get Activity Logs from the whole Power Bi tenant. That way you can store that data and build a storic of the usage to analyze whatever you want.

I hope that make sense.