The Business Intelligence Attack Surface
Enterprise reporting systems represent prime targets for data exfiltration because analytical semantic models consolidate financial records, employee compensation, customer PII, and trade secrets into queryable in-memory caches. Securing BI infrastructure requires strict defense-in-depth across the data lake, the semantic model, and the reporting canvas.
Dynamic Row-Level Security (RLS) in DAX
Dynamic Row-Level Security filters data based on the authenticated identity of the viewer executing the query. The following DAX pattern validates user access against an employee organizational hierarchy without requiring static role assignments for thousands of employees:
// Dynamic RLS Filter Expression applied to DimEmployee
[EmailAddress] = USERPRINCIPALNAME() ||
LOOKUPVALUE(
'SecurityHierarchy'[ManagerEmail],
'SecurityHierarchy'[EmployeeEmail], [EmailAddress]
) = USERPRINCIPALNAME()Securing Sensitive Columns with Object-Level Security (OLS)
While Row-Level Security restricts which rows a user can see, Object-Level Security (OLS) restricts which tables or columns exist in the model. If a report contains sensitive profit margin or salary columns, OLS configured via Tabular Editor completely hides those columns from unauthorized users. When an unauthorized user attempts to view a chart utilizing an OLS-protected column, Power BI treats the field as non-existent, preventing schema discovery.
Automating Pipeline Security with Entra ID Service Principals
Never configure scheduled data refreshes or API automation scripts using individual human employee credentials. If that employee leaves the company or changes their password, critical production pipelines fail instantly. Always use Azure Entra ID (Azure AD) Service Principals with dedicated client secrets stored securely in Azure Key Vault.
