What You Need to Know to Administer Power BI Melissa Coates Coates Data Strategies March 23, 2021 Download slides: CoatesDS.com/Presentations Melissa Coates Data architect | Technical trainer | Consultant Specialist in Power BI governance & administration Microsoft Data Platform MVP Owner of Coates Data Strategies @SQLChick | @CoatesDS Creator of Power BI Deployment & Governance Workshop Power BI Data Culture & Architecture Security & Adoption & Governance Center of Excellence Decisions Data Protection Administration Goals for This Session How and why the Power BI administrator role varies based upon the BI approach being used Introduce the breadth & scope of responsibilities Suggestions for next steps This session focuses on the commercial cloud service only. The national clouds (ex: Govt, China, Germany) are not specifically covered. Out of scope: Power BI Report Server and Power BI Embedded. What You Need to Know to Administer Power BI Agenda Admin Power BI Data Auditing & Responsibilities Service Gateways Activity Monitoring Who Should Premium & Security Suggestions Be An Admin PPU for Next Steps, Q&A Where to Download Materials Slides: CoatesDataStrategies.com/Presentations Diagram: CoatesDataStrategies.com/Diagrams Typical Power BI Administrator Responsibilities Power BI is a Broad and Deep Ecosystem Business Intelligence Approaches Top- Blended Bottom- Down Up Enterprise Managed Business-Led BI Self-Service BI Self-Service BI Centralized Decentralized Data Central IT/BI/COE Business authors ownership: Report Central IT/BI/COE Business authors ownership: In What Ways Does an Admin Support Users? Top- Blended Bottom- Down Up Enterprise Managed Business-Led BI Self-Service BI Self-Service BI Centralized Decentralized Data Management Maturity Level Internal Factors Data Culture Compliance & Regulatory Requirements External Factors Industry & Competitive Influences Where Does Administration Start & End? A lot of Data Governance Change overlap Data Management with other Architecture things Data Administration Deployment Management Security Performance Data Tuning Privacy Common Power BI Admin Responsibilities Power BI Service Workspace creation Tenant settings Security & access Gateways & data sources Auditing & monitoring Premium capacity Deployments Desktop software Licensing & user mgmt Power BI Report Server Integration w/ other apps Power BI Admins Affect the User Experience Why can’t I start Why can’t I a Pro trial? create a Why can’t I workspace? export data? Why can’t I certify a dataset? Why can’t I Why can’t I use share to this custom visual? Teams? Why can’t I install a gateway? Other Administrators & Teams Involved Global Office 365 admin Azure AD administrator SharePoint administrator Database administrators OneDrive administrator Licensing & billing admin Teams administrator Intune administrator Desktop support Security & compliance Infrastructure team Legal & risk management Networking Internal audit Who Is Allowed To Be A Power BI Administrator Who is Permitted to be a Power BI Admin? Competent Risk of too many people able to people with elevated get things done permissions independently Consider the Power BI administrator role to be a high privilege role. Power BI Administrator Role in Microsoft 365 Global Administrator Role Manage Power BI Power BI Administrator Role Service Option 1: Assign Individuals to the Role Global Administrators Global Administrator Role Manage Power BI Power BI Administrator Role Service Role assignment PBI PBI PBI Admin 1 Admin 2 Admin 3 What If You Also Use a Group? Power BI Administrators Group Tenant Settings Workspace Access Alerting Groups used to Auditing, health, Notifications allow/disallow adoption & security such as PowerShell jobs features reports or Cloud App Security Results in a situation where we have to maintain the Power BI Admin group *and* the built-in role, which is not desirable Option 2: Assign Individuals to Group that’s Assigned to Role Global Administrator Role Manage Power BI Power BI Administrator Role Service Role is assigned to the group Power BI Administrators Group Group Owner PBI PBI PBI Admin 1 Admin 2 Admin 3 Administrator-Related Groups Useful to Have (Excluding groups needed to manage most of the tenant settings) Security group Power BI Power BI administrator role (Azure AD) Administrators Workspace access: admin, auditing, adoption, security reporting Mail-enabled Power BI Tenant setting: incidents and alerts security group (Exchange) Admin Alerting Notifications from PowerShell or Cloud App Security Power BI Gateway cluster administrators Mail-enabled Gateway Admin security group OR Power BI Premium capacity administrators M365 unified Capacity Admin group Power BI Support User contact group for support How to Reduce the # of Administrators Azure AD Privileged Identity Management (PIM) Provides “just-in-time” access for Azure roles such as Global Administrator, Power BI Administrator, etc. Admin sets Eligible Approve Eligible Member is up PIM roles member the user member automatically & eligible requests to request becomes a full removed members activate a (optional) member of the from role at specific role role & performs expiration →See this blog post + video about managing necessary activity time the admin role & PIM Managing the Power BI Service Tenant Settings The tenant settings are among the most important things to get right. 1. Document decisions made (who, when, why) 2. Document the settings for decentralized users to view + which groups are used for functionality + how to get approved for a group 3. Track the ‘UpdatedAdminFeatureSwitch’ operation in the activity log 4. Alerts set up for if any changes occur Tenant Settings: Email Alerts When a Settings Is Changed →See this blog post + video about getting alerted when a tenant setting changes Workspaces View & update metadata for all non-personal workspaces* in the tenant: Name, description, and security access *V2 new workspace experience Embed Codes 1. Ensure tenant setting permits very few people to use Publish to Web 2. Track use of the ‘GenerateEmbedToken’ operation in the activity log 3. Validate the list of embed codes on a regular basis Organizational Visuals Custom visuals give report creators significantly more flexibility 1. Enable tenant setting to use certified visuals only in the Power BI Service. 2. Enable group policy to use certified visuals only in Power BI Desktop. 3. Handle exceptions to that using organizational visuals. Specific allowed visuals may include: -Internally developed visuals -Non-certified, but trustworthy & approved for use Azure Connections Azure Data Lake Storage Gen 2 account: “Bring your own data lake” for dataflows Featured Content A tenant-wide view of objects being “promoted” as featured content on Home Featured content should be used somewhat sparingly & set by relatively few people. Consider reviewing the activity log to ensure content has enough usage to warrant being featured. Monitoring Power BI System Health Power BI Support Site Azure Status https://powerbi.microsoft.com/en-us/support/ https://status.azure.com/en-us/status Microsoft 365 Includes: Admin Center Root cause Scope & user impact https://admin.microsoft.com Start & end time Next steps User Support - Internal Decide what your internal support team is willing & capable of handling, such as: Data discrepancies Technical troubleshooting (ex: refreshes & connectivity) Updates & installations Make sure your internal support team is ready & there are clear expectations (SLAs). The extent of support for enterprise content vs. self-service content needs to be clear. User Support - Microsoft Microsoft Support Option Service Level Agreement Power BI Community Best effort Web-based forum: answers from community members & Microsoft https://community.powerbi.com/ Power BI Pro User Support 1 business day Basic technical support for content authors & consumers who have a Pro license https://support.powerbi.com/ https://powerbi.microsoft.com/en-us/support/pro/ Power BI Administrator Support 1 business day or Technical support for Power Platform admins & M365 Global admins 1 hour depending on severity https://admin.powerplatform.microsoft.com/support https://admin.microsoft.com/AdminPortal/Home#/support/requests Microsoft Premier Support Varies depending on customer Enterprise support & additional training, reviews & workshops for agreement & severity customers with a Premium Support contract https://admin.microsoft.com/AdminPortal/Home#/support/requests Authoritative source: https://docs.microsoft.com/en-us/power-bi/admin/service-support-options Tenant Location Locate as close as possible to each other: • Power BI tenant • Data sources • Gateways • Users A Premium capacity node can reside in a specific geography if needed. Managing User Machines & Devices Power BI Software Power BI Desktop (monthly updates + bug fixes) Power BI Desktop Optimized for Report Server (3x/year updates) Power BI Paginated Report Builder Power BI Mobile App Ideally pushed to users so all authors Power BI App for Windows 10 are on same version Other Common Items Drivers (ex: Oracle, HANA, MS Access Engine, etc.) Analyze in Excel Provider External Tools (ex: Tabular Editor, DAX Studio, ALM Toolkit) Group Policy settings (ex: use of custom visuals) Custom connectors Managing Power BI Premium & Premium Per User 4 Workspace Types are Based on Licensing User-based My Workspace Power BI Free license named licensing Pro Workspace Power BI Pro license User-based 2 + Premium licensing PPU Workspace Premium Per User