Quick Tip: Restricting access to linked entities in Power BI dataflows

If you use dataflows with Power BI Premium, you probably use linked and computed entities. There’s an overview post here, and an example of how to use these tools for data profiling here, but in case you don’t want to click through[1], here’s a quick summary:

  • When adding entities to a dataflow, you use another dataflow as a data source
  • This adds linked entities to your new dataflow, which are basically pointers to the entities in the source dataflow
  • You then use these linked entities as building blocks for new entities, using union or merge or similar approaches

This approach is simple and powerful, but[2] it may not always give you exactly what you want. For example, what if you don’t want the users who have access to your new computed entities to also have access to the linked entities your new dataflow references?

Let’s take a look at what this looks like. I’m using the dataflow I build for that older post on data profiling as the starting point[3], so if you’re a regular reader this may look familiar.

01 dataflow before

This is a simple dataflow that contains three linked entities and three computed entities. The computed entities use Table.Profile to generate profiles for the data in the linked entities. When you connect to the dataflow using Power BI Desktop, it looks like this:

02 - consumption before

As you can see, all six entities are available to load into Power BI Desktop.

What if you only wanted users to be able to read the profiles, without also granting them access to the entities being profiled? Why do dataflows give access to both?

The answer is equally simple, and obvious once you see it:

03 - load is enabled by default

As with other dataflow entities[4], the linked entities are enabled for load by default. Removing these entities from the dataflow is as simple as clearing this setting.

04 - load disabled

Once this option is cleared for the linked entities, the dataflow will look like this, with only the three computed entities being included:

05 - dataflow after

And as desired, only these entities are accessible to users in Power BI Desktop:

06 - Consumption after

Hopefully this quick tip is helpful. If this is something that has been making you wonder, please realize you’re in excellent company – you’re not the only one. And if you have other questions about using dataflows in Power BI, please don’t hesitate to ask!


[1] Don’t feel bad – I didn’t want to click through either, and wrote this summary mainly so I didn’t need to read through those older posts to see what I said last year.

[2] As I’ve recently learned by having multiple people ask me about this behavior.

[3] Because I’m lazy.

[4] And Power Query queries in general.

5 thoughts on “Quick Tip: Restricting access to linked entities in Power BI dataflows

  1. Pingback: Dataflows in Power BI – BI Polar

  2. Christian

    Hey Matt!

    I love your blog and we’ve been running into a question based on this which is, doesn’t this prevent the ability to use computed entities?

    Like

  3. Pär Adeen

    Thanks Matthew, but just a (kind of important) comment.

    When you disable loading for the linked entities, there’s a lot of things happening.

    First of all, the linked entities are no longer a linked entity, they are now just a custom entity
    Secondly. Since the “linked entity” are no longer a linked entity, the computed entity is no longer a computed entity.

    So why is this important? This has two consequences and one extra thing that we need to think about from a cost perspective:
    1) Automated refresh from the source dataflow will not happen for the computed entities based on the linked entities. This since it no longer exists any linked entities to base the computed entities upon
    2) Since there’s no longer linked entities the source data will be double storage, once in the source dataflow and once in the destination dataflow
    3 – the extra thing to consider) Since we no loger will be using linked entities, we might also no need a premium workspace. So instead of using the premium workspace required in the first place, now we could like as well use a none premium workspace.

    Personally I think that Microsoft has missed something in their design, and that’s the possibility to hide entities (not using the disable load feature). This idea (right now only having 9 votes) tries to set a focus on this problem: https://ideas.powerbi.com/ideas/idea/?ideaid=b843bce3-68b3-45a5-8dfa-652a3374b775

    I hope that you with this comment (and the use case you see since you wrote this blog post) will be able to influence Microsofts product group to take some actions on this

    Like

  4. Pär Adeen

    Hmmm My assumption at (2) was wrong. There will be no data partition created for a none loading entity, so there will be no duplicate of data. Although, the rest of the comments are valid

    Like

Leave a Reply

Fill in your details below or click an icon to log in:

WordPress.com Logo

You are commenting using your WordPress.com account. Log Out /  Change )

Google photo

You are commenting using your Google account. Log Out /  Change )

Twitter picture

You are commenting using your Twitter account. Log Out /  Change )

Facebook photo

You are commenting using your Facebook account. Log Out /  Change )

Connecting to %s