How secure is publishing dashboard to the web (PBI Service) ?

[Anonymous]

I am a corporate Power BI user. I would like to understand more about the below article which explains about 

security issues to consider when dashboards are published to the web.

Is it true that anyone on the internet (who has the link that was created while publishing the PBI file to web) could

view the report ?

My initial understanding is, anyone who publishes the dashboard to the web, can only share the link within a

corporate's intranet and it's users. I would not be able to forward the link to people who lie outside my own

internal organisation.

What is the most secure method of sharing the dashboard then, if anyone can access it from the internet ?

Is it the embedding technique ?  But by embedding, wouldn’t this be similar to ‘sharing’ – as in, users pull data

directly from the .pbix file rather than a ‘read only’ snapshot which would have been created by ‘publishing to the web’?

https://docs.microsoft.com/en-us/power-bi/service-publish-to-web

Warning

When you use Publish to web, the report or visual you publish can be viewed by anyone on the Internet. There is no authentication used when viewing these reports. Only use Publish to web with reports and data that the anyone on the Internet (unauthenticated members of the public) should be able to see. This includes detail level data that is aggregated in your reports. Before publishing this report, ensure you have the right to share the data and visualizations publicly. Do not publish confidential or proprietary information. If in doubt, check your organization's policies before publishing.

[Maexchen]

are you really publishing to the Web or are publishing to a Workspace within your corporate space?

[Anonymous]

My current method of publishing is within the Workspace within the corporate space. I'm not able to share my web dashboard with anyone outside my corporate (as I cannot send any shareable links directly from within the Power BI webpage.

However, what if someone shares a link through a forwarded email from within the corporation to someone outside the corporation ?

So, I wanted to understand if anyone with internet access can also open the link?

[pbikaelin]

If you use "Publish to Web" then:

Yes, it is 100% open to the Internet with no authentication/authorization required.

[Anonymous]

Thanks for your response. Would this also be resulting the same affect, if I publish it to a Workspance ?

Beacuse at the moment, when I click Publish to Web, I get My Workspace as a clickable item.

Isn't the "My Workspace" actually a private cloud which is restricited only to co-workers from within my organisation ?

[Maexchen]

 believe that this is inconsistent and (bad) wording. The article you referenced is for "publishing to the web" from the PowerBI service. What you are doing is publishing to the PowerBI service (which is technically also the "web" but not the "open" one the article refers to). Our Organisation for example has deactivated the "publish to the web" option in the Power BI service. 

though someone with more knowledge than me would need to verify this.

[Anonymous]

Under "File", I see "Publish", and when I click it, the button named "Publish to Power BI" appears.

This is the only publish button I can see on my Power BI.

Hence, it'll be really helpful to understand if this is the Publish to Web or Publish to Power BI Service.

[pbikaelin]

It is exactly as described, anyone in the world with access to the internet can see whatever you "publish to web."

You may securely share the dashboard by provisioning each of your dashboard consumers with a Power BI Pro license and then assigning them to a Power BI App. The data in this app will refresh as configured in the Power BI workspace.

If you have a great number of users then you would want to investigate Power BI Premium.