PowerBI Secure Access Blob Storage

Question

I have created a PowerBI report with embedded videos using the HTML customer visual. The videos are hosted on an Azure Blob Storage so I have generated a SAS token that I have added to the video URL in my data.

However, I would look to increase the security of Blob Storage and find a better solution to avoid having a SAS token out there for everyone to use and with limited control over.

For example, would it be possible to access a token provider that would generate an access token on the fly if a set of credentials is correct? This way, I would be able to control the access to the videos.

I looked into Shared Access Signature but was not able to implement it from PowerBi. Any other ideas are welcome!

Answer 1

I tried to reproduce the same in my environment and got the results like below:

To avoid a SAS token accessible to everyone, try generating the access token by specifying user's IP address or IP Range who are allowed to access:

If the user's IP address is not in the range, the user will get the below error while accessing the SAS URL:

Would it be possible to access a token provider that would generate an access token on the fly if a set of credentials is correct.

You can make use of Authorization-Code Flow to generate the access token which will ask for the Users interaction while generating the token.

Make use of the below Parameters to generate the access token:

GET https://login.microsoftonline.com/TenantID/oauth2/v2.0/token

 

client_id:ClientID
client_secret:*****
grant_type:authorization_code
scope:scope
redirect_uri:redirect_uri
code:code

A sign-in screen will appear to validate the Users credentials:

Access token got generated successfully like below: