Securing datasets when using Power BI Service

When using the Power BI Custom Connector in Power BI Desktop, the user’s credentials are enforced when connecting to IBM Planning Analytics. This ensures that the user has only access to the IBM Planning Analytics data, which the user has been permitted to see.

When a data source is configured in the Power BI online service, single sign in credentials - typically that of an IBM Planning Analytics administrator - are configured to access the content.

This means that data refreshes are performed with administrator access.

The below section outlines some approaches, which can be applied to secure the IBM Planning Analytics data for end users.

Self Service

If (non-admin) end users are enabled to access IBM Planning Analytics data via the Power BI Custom Connector [i.e. in Power BI desktop], it is recommended that the data source configured in the Power BI online service is not accessible to the end users. [This will prevent the end user from refreshing the data sets with administrator credentials – end users are able to view the report and associated data sets, but the data sets cannot be refreshed.]

Data refreshes will be performed in Power BI desktop using the Power BI custom connector, which enforces the IBM Planning Analytics security.

The refreshed report alongside the dataset can now be published to the Power BI online service and can be accessed by the user.

Other alternatives

In some cases, where the IBM Planning Analytics data can be divided into portions, which reflect the security setup, multiple data sources can be setup for each portion with the appropriate credentials.

For example, if one set of users is allowed to only access the version "Actuals" and another set of users is allowed to access versions "Actuals and Budget", two data sources can be configured with the appropriate credentials.