Getting started with Power BI Administration
This blog post is for those organizations and admins who are just starting their journey with Power BI. I try to give you some recommendation for temporary tenant setup until you get familiar with Power BI and make the necessary decisions about how you want to use it. Until you have your Power BI Governance Framework in place.
Lot of times when I start discussing governance with organizations, they are already deep into using Power BI. Hundreds and thousands of Workspaces, Reports and Datasets. This is when they realize that Self-Service BI can easily get out of control, and they need to do something to be able to manage it.
In one example the company had more the 3.000 published reports with less than 20% actually used, generating a lot of asset management, data security and performance problems.
I did a piece on Power BI administration a while back that covered some of these topics, but it was not specifically focused on this specific area, so I thought I will cover this in a separately.
Since then, plenty of new setting are available, but the general approach still remains the same.
I will list those first few tenant settings that you should change before the situation gets out of hand.
1. Automatic Free Licences Assignment
By default, anyone in your organization who visits PowerBI.com or receives a shared link of a Power BI report can sign-up for a free licence.
Here is a video by Adam Saxton from Guy in a Cube YouTube channel explaining this:
Here is the article about this topic from Power BI documentation:
Reasons to have it turned off:
- To be in control who can use Power BI specially to control access to 3rd parties who have users in your tenant.
2. Paid Trial Features
By default, anyone can sign up to 60-day trial period for either a Pro or Premium Per User licence.
Reasons to have it turned off:
- If you have a premium capacity licences, then free and pro user licences are used to differentiate between creators and consumers. Let’s you control who can be creator. For example, by requiring training participation to get Pro licences.
- Enabling this feature can generate a lot of half-finished or abandoned reports in the service which will create a lot of management need going forward.
- If you end up not giving paid Pro licences to some trial users that can generate unnecessary tension within the organization.
3. Workspace creation
Workspace creation is one of the areas that can get out of hand pretty quickly if not controlled. You should limit this ability to a small group of people before you have a clear concept how you want to use workspaces.
Eventually this should be part of an automated process which will setup workspaces for a project/department/region/etc. in a controlled way.
Also make sure that classic workspace creation is blocked. Should be set up this way by default. You can read about classic and new workspaces here.
Reasons to have it turned off:
- Workspaces should be used to manage access to different entities and state of solutions: Data and Report, Dev, Test, and Prod
- Empty, abandoned workspaces generate a lot of asset management tasks
4. Custom Message for Publishing
This is a really useful recent addition to the administrator’s toolbox. I recommend that you make it clear in the message that what responsibility they bear when they publish a dataset. Especially initially when most likely not all the security automation is in place.
This is how it appears for an author when trying to publish a report.
Reasons to have it turned on:
- Make sure the authors have a clear understanding about their responsibilities
- Until a more structured governance is implemented you need to rely more on the authors making the right decision about data security and sharing
5. Publish to Web
This feature is an effective way to share data with the public. You can check some examples here: https://www.factfactory.co.uk
But it is a security risk if not used properly.
Initially most organizations do not want to use Power BI to share information with the public, so it is safe to feature off.
You can also check if anything is already published this way:
Reasons to have it turned off:
- Unsecure way to share a report
- Discoverable by search engines
- People sometimes unintentionally use this feature
6. Guest user access
These settings control how people outside of your organization can get access to the content in your tenant.
Again, initially until you define proper rules and processes it is better to block access.
Reasons to have it turned off:
- Guest user access can easily be misused.
- Currently available audit information makes it hard to fully understand who has access to what data.
- Better to make sure you have the policies in place before you allow external sharing.
7. R & Python visuals
R & Python are programming languages that have strong data analytics capabilities. In Power BI you can use them for data preparation and data visualization.
These can either be turned on or off. You don`t have the option to limit is to a certain group of users.
Reasons to have it turned off:
- Because they are programming languages, that is a risk to create, run code that can be harmful
8. Custom visuals
Power BI is an open platform for the community to create visualization using the SDK provided by Microsoft.
Custom Visuals then can be shared with the community using the AppSource marketplace.
Developer can certify their visuals with Microsoft. This ensures that it has a good quality code and data is not sent outside of the tenant.
It is also possible to block uncertified custom visual in the desktop. Here is the documentation on this.
Reasons to have it turned on:
- Uncertified visuals might send data outside your organization
- Setting it later can break already published reports
Conclusion
There is a lot more administration/governance decisions you will have to make in the future, but if you are just starting with Power BI at least you know what to focus on first.
Hope you found this useful and if you want to get notified about similar blog posts please register for the newsletter.
