Whats the best way to manage credentials in reports that are published to the business to use

[Jimbo2500]

Hi,

Whats the best way to manage the credentials that are used in the creation of various reports that are published to the business to view?

We use an on prem data gateway, but also link into things like SharePoint Online lists.

Should we use a service account for the data gateway credentails and for the cloud service data sources and if so is there a way to easliy change the various cloud service credentials as an admin so that the developers can continue using their credentials whilst developing but when they are published they can automatically use pre determined service account credentials?

The on prem data gateway side seems ok as we can setup the various data sources in there with the service credentials and then the developers can use those sources, but its not as obvious how we should manage other data sources.

Thanks in advance

James

[v-stephen-msft · Accepted solution]

Hi @Jimbo2500 ,

You can view the credentials of your data source in the data set by clicking Settings.

Store encrypted credentials in the cloud

When you add a data source to the gateway, you must provide credentials for that data source. All queries to the data source will run by using these credentials. The credentials are encrypted securely. They use symmetric encryption so that they can't be decrypted in the cloud before they're stored in the cloud. The credentials are sent to the machine that runs the gateway, on-premises, where they're decrypted when the data sources are accessed.

You can change your credentials in Power BI Desktop.

File => Options and Settings => Data Source Settings

Do you want to know about adding users to a data source?

Please kindly refer to: https://docs.microsoft.com/en-us/power-bi/connect-data/service-gateway-data-sources#add-users-to-a-d...

Best Regards,

Stephen Tao

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[lbendlin]

"Should we use a service account for the data gateway credentails and for the cloud service data sources and if so is there a way to easliy change the various cloud service credentials as an admin so that the developers can continue using their credentials whilst developing but when they are published they can automatically use pre determined service account credentials?"

yes?  That's how this usually works. The gateway connection credentials for on-prem data sources are independent of the credentials that the developers specify when they do their developering. 

Adding cloud data sources to a gateway is a contentious topic. My view is that this is highway robbery because basically Microsoft offloads the rendering/processing responsibilities to the customer's computing resources instead of doing the rendering/processing in the Azure cloud.  We already pay dear money for the Premium capacities, and now they want us to work for them too? (not even mentioning that this can backfire spectacularly when your gateway is not up to snuff, performance wise.)