The distribution ladder (least to most dangerous)
| Mechanism | Reaches | Governed? | Risk |
|---|---|---|---|
| App + audiences | Defined internal audiences | Yes — the intended channel | Low |
| Workspace role (Viewer) | People in the workspace | Yes, but couples read with the authoring container | Medium |
| Direct share (per item) | Named individuals/links | Weakly — accumulates invisibly | Medium–high |
| 'People in your org' link | Anyone in the tenant with the link | Broad | High |
| Publish to web | ANYONE on the public internet, no auth | No | Critical |
Apps — the way distribution should work
An app packages a workspace's chosen content into a polished, read-only product with defined audiences — different audience groups can see different subsets. Consumers get the app, not the workspace, so authoring and consumption are cleanly separated and access is managed in one place. This is the pattern to push everyone toward.
Direct sharing and links
Per-item sharing grants a specific report/model to named people or via a link. Link scopes include 'people in your org', 'specific people', and (if allowed) external. It's convenient and it's the oversharing trap: shares pile up, nobody prunes them, and 'who can see this' becomes unanswerable. Links scoped to 'people in your org' quietly expose content to the whole tenant.
Publish to web — the guillotine
Publish to web generates a public embed code that makes a report readable by anyone on the internet with no authentication. It is designed for genuinely public data and is the single most notorious accidental-leak vector in Power BI — internal dashboards, financials and customer data have been exposed this way. It should be disabled or tightly allowlisted at the tenant level, and every existing embed code should be inventoried.
Failure modes
- Publish-to-web left enabled org-wide — one user one click from a public leak.
- Direct-share sprawl as the de-facto distribution model — ungovernable ACL.
- 'Whole org' links treated as 'my team' — tenant-wide exposure.
- External sharing on without an allowlist — data reaches guests/other tenants.
- Apps that over-include — an audience granted content it shouldn't have because the app wasn't scoped.
What to watch (proofs)
- Publish-to-web inventory: the admin portal's embed-codes page and the
admin/widelySharedArtifacts/publishedToWebREST endpoint list EVERY publicly exposed report — run it; the findings are often alarming. - Broadly-shared content:
admin/widelySharedArtifacts/linksSharedToWholeTenantsurfaces items shared with the entire org via links. - Share/permission census: the admin scanner (
admin/workspaces/getInfo) returns per-item users, exposing direct shares beside the app model. - Sharing tenant settings: publish-to-web, external sharing, and 'share to whole org' settings' state and delegation, captured nightly with alerting on change (governance concept).
- Distribution activity:
Get-PowerBIActivityEventlogs share, publish-to-web, and app-publish events with the actor — the change feed for exposure.