Restrict access to PowerBI portal (service)

[cjvjr75]

Hello

I have a question about restricting Pro and Free users to access the PowerBI portal(Service)

In our tenant we have 2 security groups. One for Free users and one for Pro users.

I noticed that these groups are related to licenses we bougth and giving access to the PowerBI portal (service)

We bought 20 Pro licenses in the past. We can see these licenses in the Azure portal. When i add a user to the Pro users group in Azure, we see that one license it being taken and that there are 19 left. However, it also means that from now on this person can access the PowerBI portal (Service) and publish content. The same applies to the Free group. We don't need to buy licenses for this type of user, but adding a user to the group does mean the user can access the PowerBI portal (service) but is unable to publish content. If a user is not a member of either the Free or Pro group, he/she gets the message that he/she cannot access the portal.

What we want to achieve is that we are able to add users to Pro group in order to give them a Pro license, but not give them access to the PowerBI portal (Service)

We want these users to be able to work only with the PowerBI Desktop and PowerBI Reporting server. Both on premise products.

Since one needs to have a Pro license as well to be able to publish something on the PowerBI Reporting Server, we still need to assign a Pro license to the specified users.

What is or are the best way(s) to achieve this?

greetings,

Kick

[v-kelly-msft]

Hi @cjvjr75 ，

Check the license in reference:

https://docs.microsoft.com/en-us/power-bi/report-server/compare-report-server-service

I think Pro license is not a must for RS.

 
Best Regards,
Kelly

Did I answer your question? Mark my post as a solution!

[cjvjr75]

@v-kelly-msft 

Hi Kelly

The article in link you posted is only talking aboyt PowerBI RS and the PowerBI Service. Not what is needed for PowerBI Desktop in relation to PowerBI RS. 

It has the same information as on the link you have sent, 

Power BI Report Server is available through two different licenses: Power BI Premium and SQL Server Enterprise Edition with Software Assurance. 

but also states:

If you publish Power BI reports to Power BI Report Server, you also need a Power BI Pro license

If its not a must, please explain the above sentence from the MS article i have sent.

I agree, is is using the word "publish". That is a bit strange since you "Save as" a report when working with PowerBI RS. But, basically it the same. You are placing something either on a server or a service.

[cjvjr75]

To everyone

Can we please stop the licensing dicussion here? My question was about restriction access to the portal. So far only Greg gave me some answers.

If there are people who want to advise their costumers not to buy Pro licenses in relation to PowerBI RS, then that is fine by me.

Your software will work fine, but in my opinion you are not correctly licensed.

[ibarrau]

Hi. I haven't fully understand all but let me clarify one thing that might be helpful. The pro license is ONLY useful online. Pro will help you with Power Bi Service, Embed in custom app, sharepoint or teams. If you plan to use Power Bi in SQL Server Report Server from SQL Server Enterprise license, then you don't need pro. Power Bi Desktop Report Server is free to use. Create your reports and save them in your on premises Power Bi Report Server. That way you are already paying for your server, you don't have to pay for individual licenses.

Hope this help.

Regards,

[cjvjr75]

@ibarrau 

I am afraid its not true that PowerBI Reporting server is free to use. You also need a Premium license or SQL ENT with SA contract for that. We dont have SQL ENT with SA, so we went for Premium. Also, users who want to publish on the PowerBI RS also need a Pro license. See

https://docs.microsoft.com/en-us/power-bi/report-server/get-started

Licensing Power BI Report Server

Power BI Report Server is available through two different licenses: Power BI Premium and SQL Server Enterprise Edition with Software Assurance. See Microsoft Volume Licensing for details. With a Power BI Premium license, you can create a hybrid deployment mixing cloud and on-premises.

If you publish Power BI reports to Power BI Report Server, you also need a Power BI Pro license. You don't need a Power BI Pro license to view and interact with Power BI reports on Power BI Report Server.

So even when you only use the PowerBI product on premise, you still need licenses.

[ibarrau]

I'm sorry but you can't avoid Service access for a pro user. I thought you had SQL Server Enterprise. I have never known about a customer buying premium for report server purpose. The SQL Server enterprise would be the way to keep all users without pro saving reports and without having access to Power Bi Service. A pro user will be able to get in Power Bi Service. I don't think you can restrict that.

Hope this helps

Regards,

[cjvjr75]

@ibarrau 

I don't think you will get away with only a SQL ENT with SA license. You then also still need a Pro license.

Maybe you are mixing up SQL Server Reporting Server (SSRS) and PowerBI Reporting Server. Under the hood almost the same, but not the same products. Fot SSRS you don't need Pro licenses. For PowrBI RS you do need them in order to publish something.

As in the MS article, there are two ways to license a PowerBI Reporting server. You can have either a Premium license or a SQL ENT with SA contract. For every user that publishes something on the PowerBI RS you need a Pro license.

Kick

[ibarrau]

I don't think so. We have a test environment in our company for a lot of things. I have just saved a report with Power Bi Desktop RS (may 2020 version) to a Report Server without any kind of login in the desktop. That means you don't need pro for creating and saving reports in RS.

Regards,

[cjvjr75]

@ibarrau 

I  really think you are mixing two things up here.

Simply saving a report to a PowerBI Report Server doesn't say you are correctly licensed. Its not that easy.

Yes, things will work. If i install PowerBI Reporting Server and choose a Developer license in the beginning everything will work great. But is this server then correctly licensed as a production server? I don't think so.

Please do read the article of Microsoft i mentioned above!

It states:

If you publish Power BI reports to Power BI Report Server, you also need a Power BI Pro license. You don't need a Power BI Pro license to view and interact with Power BI reports on Power BI Report Server.

So please stop the advise by saying you only need Pro licenses for online use only. Thats incorrect.

[Greg_Deckler]

@cjvjr75 - One question because I don't do a ton with PBRS. Does PBRS reject you if you try to publish a Power BI report to the server and do not have a Pro license? In other words, you could potentially purchase the licenses but not assign them and you would meet the license requirements imposed by Microsoft.

If that is not the case, if everyone accesses the Service via your network and you have split-brain DNS, you could potentially block them that way or via a firewall, etc.

Failing that, you might be able to achieve this using Conditional Access policies. Just create a conditional access policy for Power BI Service that rules out everyone.

[cjvjr75]

@Greg_Deckler 

Hi Greg,

Thanks for your answer..

You are correct. If its possible to publish something on the PowerBI RS without making that person a member of the Pro or Free group will do the trick. However, i am not sure if this is "legal" in the eyes of Microsoft. Is this licensing feature in Azure not something MS will use during an audit or something?

Kick

[Greg_Deckler]

@cjvjr75 - You are correct, regardless of Premium, etc. my understanding is that you still require a Pro license to publish to PBRS. Now, in my opinion, as long as you can show that you have a Pro license purchased for each user that has published a report on PBRS, I would think that would meet the conditions of an audit even if they were not assigned. But, I'm not an auditor from Microsoft so who knows! 🙂