I have a requirement of displaying images on Power BI report. These images are currently stored on Azure Storage v2 and the storage account is only accessible via private link/endpoint (public network access is disabled). So Power BI needs to call the private link URL (e.g. storageacc1.privatelink.blob.core.windows.net/container1/folder1/image1.jpg) to get the images rather than the public blob URLs. Can we make this solution work by using VNET Data Gateway with a Private DNS Zone which will resolve the incoming domain name (*.privatelink.blob.core.windows.net) to the private IP of the storage account? Is this a feasible solution for rendering images on Power BI from private Azure storage account?
Add a comment
|
1 Answer
Power BI reports load images from the client, so not unless the users browsers can directly download the image URLs anonymously (eg with a SAS token in the URL).
answered Oct 14 at 14:30
David Browne - Microsoft
90.7k7 gold badges52 silver badges87 bronze badges
4 Comments
Tanmoy Sengupta
Sorry, I did not follow. As per this MS documentation - learn.microsoft.com/en-us/data-integration/vnet/…, this seems should be possible? ADLS Gen is indeed supported and we are using Power BI Premium. What am I missing?
David Browne - Microsoft
Are all your users on the private network? And can you use SAS URLs
Tanmoy Sengupta
Users are internal users of the org, who will access the reports from Power BI portal (app.powerbi.com). I know we can use SAS URLs, but I believe that's less secure and we need to refresh the SAS token very frequently (hourly or so) to minimize security risk. If we still run an hourly job to regenerate SAS token, how will we update the semantic model with the new token every hour?
David Browne - Microsoft
Refresh a single-row table that contains the token, and use a measure to construct the full URL. Or add multiple tokens ahead-of-time and pick the valid one in the measure.