Is it possible to remove the Share button when you publish to web?

[Anonymous]

I like the ability to publish a report to the web anonymously.  However, I still have this embedded on a site that does require a login.  The problem is, there is a Share button at the bottom of the embedded report which I don't want others to access, because they could easily post that URL elsewhere that's not behind a login.  I understand I'm using this as quasi-security, but I still don't want others to easily re-share that page out to just anyone.  Thoughts?  Thank you!

[v-sihou-msft]

@Anonymous

Currently, it's still not supported to hide/disable Share button, unless use Power BI embedded as @Seth_C_Bauer suggested. Please vote this idea.

Regards,

[Seth_C_Bauer]

@Anonymous I doubt you will like my thought, but here it is. Use Power BI Embedded or if it is an internal site use the DEV Tools to embed. The "Publish to the Web" feature is specifically designed for sharing and making information publically available. It's a rarity that a direct warning against use cases is given by MSFT, and there is one, front and center on the Publish to Web documentation. You are making your data publically available using that feature...

As a aside, I don't know what application you are using, but they just released an easy integration option for SharePoint online web parts. (requires you to be an "Office 365 Early Release" customer).

To directly answer your question, I am not aware of any control that would allow you to remove the share.

[Nimtar]

Hi @Seth_C_Bauer,

This is a HUGE security flaw in PowerBI, even when using the PRO version.

It's EXTREMELY URGENT that Microsoft provide an option to disable Sharing.

Thanks

Martin.

[Seth_C_Bauer]

@Nimtar What is a huge security flaw? "Publish to Web" is designed for public facing data, you inherintly understand that everything in the report is public... As that is the case, it doesn't matter who shares it.

[Nimtar]

You are assuming publishing to the web makes it public but it only does if someone shares the link.

If the link cannot be shared and the dashboard is embedded then it is secure.

Publish to web is the only feature allowing sharing with people that don't have a PowerBI account.

Do you see any other way to publish a dashboard securely for people without PowerBI accounts?

[Seth_C_Bauer]

You are assuming publishing to the web makes it public but it only does if someone shares the link.

I'm not assuming anything. The minute you generate the link, that URL is discoverable to anyone on the internet. I've confirmed this with my security experts and if someone wanted to, they could easily discover any of the generated URLs as they all follow the same pattern. There is a reason there is an explicit warning on the article provided by MSFT - here

If the link cannot be shared and the dashboard is embedded then it is secure.

The use of the actual embedding tools that MSFT provides in their developer sections will ensure that the embedded visual is secure.

Publish to web is the only feature allowing sharing with people that don't have a PowerBI account.

Not accurate, Power BI Premium as well as the Power BI Premium Embedded licenses allow you to share with free users.

Premium starts at 5K a month and is designed for large companies. 

Premium Embedded was just announced at the Data Insights Summit this week and will come out at $625 a month

Do you see any other way to publish a dashboard securely for people without PowerBI accounts?

Described above. 

As of June 1st, all methods of sharing securily were stripped from the Free License and all the abilities to use gateways and all the datasources were added to the free license. The methods to share with free users are described above.

[meruuuli]

You are assuming publishing to the web makes it public but it only does if someone shares the link.

I'm not assuming anything. The minute you generate the link, that URL is discoverable to anyone on the internet. I've confirmed this with my security experts and if someone wanted to, they could easily discover any of the generated URLs as they all follow the same pattern. There is a reason there is an explicit warning on the article provided by MSFT - here

Could you please explain what patterns do they follow or share materials where I can read more about it. 

Would much appreciate!

Thank you!

[Seth_C_Bauer]

@meruuuli There isn't any in depth documentation on how someone might take advantage of finding publish to web reports... because then people could take advantage of others who use Publish to Web the wrong way. A simple search of "site:app.powerbi.com" in google produces a whole slew of reports that are published to web. There are many other ways to refine the search and that is just using searching techniques.

Assume that this feature is not safe for private company information. You are most likely breaking your company data security policies by using it with non-public information.

Since this original conversation, there are now 2 or 3 dialogue boxes that you have to get through now, all warning users of this.

As a side note, there is also the new functionality to use "Embed" - this is exactly like publish to web in ease of use, but requires end users to log in with their credentials.

[Nimtar]

Thank you Eno, we didn't know this.

I will let my team know and will uodate accordingly.

Cheers!