Understanding Licensing and Secure Report Access

Power BI Licensing Basics

Power BI capabilities depend on the licensing and capacity configuration used by the organization.

Common concepts include:

• Power BI Free: Supports personal use and certain consumption scenarios, subject to current service restrictions.
• Power BI Pro: Supports collaboration, publishing, and sharing capabilities covered by the license.
• Power BI Premium Per User (PPU): Provides additional capabilities for eligible users and content, subject to its licensing requirements.
• Capacity-based options: Allow organizations to host content in eligible dedicated capacities, with consumption rules that depend on the specific capacity and license arrangement.

Licensing rules can change, so verify the current Microsoft Power BI licensing documentation before choosing a distribution strategy.

Do not assume that publishing a report makes it accessible to every user in the organization. Both the publisher and consumers may need appropriate licenses or access to an eligible capacity.

Row-Level Security (RLS)

Row-level security restricts which rows of data a user can see.

For example, a company may want each regional sales manager to see only the sales records associated with their assigned region.

A model might contain a Region column and use a security role to filter data.

An illustrative DAX filter expression for a role assigned to the North region could be:

[Region] = "North"

The expression is applied as a table filter in the appropriate security role, using the actual table and column names from the model.

After configuring RLS in Power BI Desktop, publish the model and assign users or groups to the appropriate roles in the Power BI Service.

Testing RLS

Before releasing a report:

1. Define the required security roles.
2. Test the roles in Power BI Desktop using the available role-testing feature.
3. Publish the model.
4. Assign the appropriate users or groups to the roles in the Service.
5. Verify that each user sees only the intended data.

RLS primarily filters data for users with Viewer-level access to the semantic model. Workspace Admins, Members, and Contributors generally have edit-level access that is not restricted by RLS in the same way.

Therefore, do not assign elevated workspace roles to users who must be restricted by row-level security.

Protecting Sensitive Data

Follow these practices when sharing reports:

• Grant access only to intended recipients.
• Avoid public sharing for confidential information.
• Review export and reshare permissions.
• Use RLS when different users should see different rows.
• Follow organizational policies for personal and sensitive data.
• Review access when employees change roles or leave the organization.

A secure report distribution process protects data while allowing authorized users to make informed decisions.