- Power BI
Accessing the right data in Power BI: how to keep a grip on who sees what
Accessing the right data in Power BI: how to keep a grip on who sees what
You've developed Power BI reports. The data are right, the insights are valuable and the layout is neat. But now comes the big question: how do you make sure the right people get to see the right data - and most importantly, that others don't?
Defining and assigning the right access rights is done in three steps:
- Define the target groups and their members;
- Define the reports for each target group;
- Screen the row-level data with Row-Level Security (RLS).
The case: a coffee chain with three types of users
We illustrate the 3 steps using a case at Viva Mona , a fictitious chain of coffee shops spread across Belgium. You have developed two Power BI reports:
- Financial reporting - which shows sales, costs and margins, among other things;
- Store analysis - which shows sales figures, customer data and inventory levels, among other things.
Step 1: Define the target audience and their members
Power BI reports are best shared through a Power BI app. This is a type of environment where you bundle one or more reports, ready to share with your end users. End users can thus access all their reports in one central place.
In the Power BI app, you create one or more target groups. To these target groups you then assign individuals based on their individual email addresses or Microsoft Entra groups.
Case:
You identify three target groups: head office, area managers, and store managers.
Each of these target groups has multiple members:
You create these three audiences in the Power BI app and add the members via their email address.
Step 2: Determine the reports per target group
In the second step, you determine which reports members are allowed to see for each target group. This way you can make a report available to one target group, but keep it hidden from another.
If you add a new report in the application, it will automatically be hidden from all target groups. You must then grant access per target group if necessary. This way you avoid members unintentionally seeing new reports.
Case:
Head office will have access to our two new reports. This will give them insights into the entire financial situation, and they can also monitor the different stores.
However, the regional and store managers do not need access to the financial reports. Head office prefers to shield this data, so they only need access to the store analysis.
You specify in the Power BI app that headquarters may see both reports, but the target regional and store managers only the store analysis.
Step 3: Shield row-level data with Row-Level Security (RLS).
Even if a report is visible to a user, you often want to limit data to what is relevant. You do this through RLS. Through this row-level security, you determine - as the name implies - whether or not a member within the target audience is allowed to see a row from a table. Of course, you don't have to do this per row, but through rules in your data model.
So with RLS you don't have to build separate reports containing other data. Power BI automatically adjusts it per user.
Case:
In the store analysis report, you want to shield certain data. For example, the store manager can only see the data (sales, inventory, staff, etc.) from his or her own store. You don't want them to be able to see the data from the other stores.
You set this up by defining a manager for each store in the data model, and also adding the e-mail address of this manager. When he or she logs in, this person will only see the data of their own store. The rest will be filtered out automatically.
You set up a similar logic for the region managers. Each store falls within one region, so you want the area managers to see only the stores within their region. They should not be able to consult stores from another region.
For the head office, we do not set RLS rules. They may have access to all the data in the reports.
Summary
Access management in Power BI is not just about “Who is allowed access to reports?”, but also about:
- Which reports is someone allowed to see? (via app settings)
- What data is someone allowed to see within a report (via RLS)?
By making smart use of apps, targeted visibility and Row-Level Security, you ensure that everyone sees only what they need to see - and no more than that.
Once set up, everything goes through the end user's email address. All the end user has to do is log into Power BI Service to access all the content he or she is allowed to access. This also means that a person without access rights who would click on a link to the reporting would not see anything at all.
Want to learn more about Viva Mona from the case? Be sure to take a look through this link to our Power BI demo!
Need support setting up access rights for your reporting? Or are you curious how we bring your organization to quick and accurate insights?
