Block Power BI desktop access to Business Central for certain users

(1) Share

Report

Posted on by Samantha73

3,132

Hi
Currently any user with power BI licenese can acess Business Central Data via the PBI desktop. is there anyway some users can be blocked creating new reports and exploring data using power BI desktop/online? We know how to restrict access once published to workspace form workspace security.

Categories:

Dynamics 365 Business Central

I have the same question (0)

All responses (2)

Answers (0)

Suggested answer

Sahan Hasitha 818 on at

Like (0)

Report
Block Power BI desktop access to Business Central for certain users

hi

Restrict BC Data Access (Best Practice)

Only give the users the minimum permissions in Business Central security roles.

If they cannot read certain tables/pages, then even if they try in Power BI Desktop, the data won’t load.

Example: Create a read-only reporting role for Business Central, and exclude sensitive tables (like G/L, Vendors, etc.).

Use Azure Active Directory (AAD) Security Groups

Put “report creators” in one AAD group and “report consumers” in another.

Only give the creator group access to the OData / API endpoints in Business Central.

Consumers can still view published reports in Power BI Service, but cannot build their own.

Data Access Layer with Azure / Power BI Datamarts

Instead of letting all users connect directly to BC OData feeds, centralize the data via a Dataflow / Datamart / Lakehouse.

Only BI developers can access the raw BC connectors. End users only see curated datasets published in Power BI Service.

Governance Policy

Document/reporting policy: Only assigned BI developers should use Power BI Desktop to connect to BC.

Technical enforcement: Use Conditional Access in Azure AD to restrict access to the BC API endpoints for certain users.

Was this reply helpful? Yes No
Suggested answer

Pallavi Phade 638 on at

Like (0)

Report

Block Power BI desktop access to Business Central for certain users

Namaste Samantha

I can surely advise you how we can restrict in BCE not sure of other ways .

Below are the Permission sets by default set by Microsoft for Power Bi

You can restrict these permission set to user . And create copy of this permission set and do the necessary changes .

And modify the effective permissions . As per your custom tables , access

And also check licenses provided to user in user card

Below link will help you to usage of APIs and how it can be permitted

https://learn.microsoft.com/en-us/dynamics365/business-central/admin-powerbi-setup

Sharing some other referneces where this is restriced in PowerBi services .

https://www.syskit.com/blog/power-bi-workspace-permissions-roles-and-report-on-who-has-access/

https://community.fabric.microsoft.com/t5/Service/Restrict-access-to-PowerBI-portal-service/m-p/1255731

if you feel this answer was helpful , Please verify the answer

Regards

Pallavi Phade

Was this reply helpful? Yes No
Suggested answer

Gauravsingh.rajput@... 45 on at

Like (1)

Report
Block Power BI desktop access to Business Central for certain users

Hi Samantha,

Please try below solutions

1. Restrict Access via Business Central Permission Sets
You can control which users can access Business Central data by customizing permission sets:

Create a custom permission set that excludes access to tables, pages, and queries exposed to Power BI (especially those used in APIs or OData).

Assign this restricted permission set to users who should not be able to connect to Business Central from Power BI.

Remove any other permission sets that might grant access to those data entities

2. Use Azure Conditional Access Policies
Azure AD (now Microsoft Entra ID) allows you to block access to Business Central from Power BI:

Go to Azure AD > Security > Conditional Access.

Create a policy targeting specific users or groups.

Under Cloud apps, select Business Central.

Under Client apps, choose Power BI as the blocked app.

Under Access controls, select Block access.

Enable and test the policy before rolling it out broadly1. Restrict Access via Business Central Permission Sets
You can control which users can access Business Central data by customizing permission sets:

Create a custom permission set that excludes access to tables, pages, and queries exposed to Power BI (especially those used in APIs or OData).

Assign this restricted permission set to users who should not be able to connect to Business Central from Power BI.

Remove any other permission sets that might grant access to those data entities

Was this reply helpful? Yes No