v0.1.0-draft AI Drafted
Home / Guides / Power BI

Power BI Hardening Guide

Analytics Last updated: 2025-12-14

Microsoft BI security for tenant settings, gateway credentials, and embed controls

Overview

Microsoft Power BI provides business intelligence with data connections across enterprise sources. REST API, embed tokens, and dataflows access sensitive business data. Compromised access exposes executive dashboards, financial reports, and aggregated business intelligence through the Microsoft 365 ecosystem.

Intended Audience

  • Security engineers managing BI platforms
  • Power BI administrators
  • GRC professionals assessing analytics security
  • Third-party risk managers evaluating Microsoft integrations

Table of Contents

  1. Authentication & Access Controls
  2. Content Security
  3. Data Source Security
  4. Monitoring & Detection

1. Authentication & Access Controls

1.1 Enforce Conditional Access

Profile Level: L1 (Baseline) NIST 800-53: IA-2(1)

ClickOps Implementation

Step 1: Configure Conditional Access (Azure AD)

  1. Navigate to: Azure AD → Conditional Access
  2. Create policy for Power BI
  3. Require MFA
  4. Configure device compliance

Step 2: Enable Sensitivity Labels

  1. Navigate to: Power BI Admin Portal → Tenant settings
  2. Enable: Information protection
  3. Configure label inheritance

1.2 Workspace Access Controls

Profile Level: L1 (Baseline) NIST 800-53: AC-3, AC-6

ClickOps Implementation

Step 1: Define Workspace Roles

Role Permissions
Admin Full workspace control
Member Edit and publish
Contributor Edit only
Viewer View only

Step 2: Configure Workspace Settings

  1. Create workspaces per team
  2. Assign minimum required roles
  3. Limit external sharing

2. Content Security

2.1 Configure Sharing Defaults

Profile Level: L1 (Baseline) NIST 800-53: AC-21

Description

Control report and dashboard sharing.

Rationale

Attack Scenario: Public publish to web exposes financial reports; embed tokens enable unauthorized dashboard access.

ClickOps Implementation

Step 1: Tenant Settings

  1. Navigate to: Power BI Admin Portal → Tenant settings
  2. Configure:
    • Publish to web: Disabled
    • Share content externally: Restricted
    • Allow external users to edit: Disabled

Step 2: Export Controls

  1. Configure: Export data settings
  2. Limit export formats
  3. Audit export activity

2.2 Embed Security

Profile Level: L2 (Hardened) NIST 800-53: AC-21

Implementation

Step 1: Secure Embed Tokens

  1. Use app owns data pattern with service principal
  2. Implement row-level security
  3. Set token expiration

Step 2: Embed Controls

  1. Navigate to: Tenant settings → Developer settings
  2. Restrict who can embed
  3. Limit embed token generation

3. Data Source Security

3.1 Gateway Security

Profile Level: L1 (Baseline) NIST 800-53: IA-5

ClickOps Implementation

Step 1: Manage Gateway Users

  1. Navigate to: Settings → Manage gateways
  2. Limit gateway admins
  3. Review data source credentials

Step 2: Data Source Credentials

  1. Use service accounts
  2. Limit database permissions
  3. Rotate credentials periodically

3.2 Row-Level Security

Profile Level: L2 (Hardened) NIST 800-53: AC-3

Implementation

Step 1: Define RLS Roles

[Region] = USERPRINCIPALNAME()
-- Or use security groups
PATHCONTAINS("Finance", USERPRINCIPALNAME())

Step 2: Test RLS

  1. Use “View as” feature
  2. Test with different users
  3. Audit RLS effectiveness

4. Monitoring & Detection

4.1 Activity Log

Profile Level: L1 (Baseline) NIST 800-53: AU-2, AU-3

ClickOps Implementation

Step 1: Access Activity Log

  1. Navigate to: Power BI Admin Portal → Audit logs
  2. Or use: Microsoft 365 Compliance → Audit
  3. Configure log retention

Detection Focus

// Detect report exports
PowerBIActivity

| where Activity == "ExportReport"
| summarize count() by UserId
| where count_ > 10

// Detect embed token generation
PowerBIActivity

| where Activity == "GenerateEmbedToken"
| project TimeGenerated, UserId, ReportId

Appendix A: Edition Compatibility

Control Pro Premium
Conditional Access ✅ ✅
Sensitivity Labels ✅ ✅
Audit Logs ✅ ✅
BYOK Encryption ❌ ✅

Changelog

Date Version Maturity Changes Author
2025-12-14 0.1.0 draft Initial Power BI hardening guide Claude Code (Opus 4.5)