Immuta can enforce policies on data in your dashboards when your BI tools are connected directly to your compute layer.

This page provides recommendations for configuring the interaction between your database, BI tools, and users.

Connect directly to the database instead of extracts or imports

To ensure that Immuta applies access controls to your dashboards, connect your BI tools directly to the compute layer where Immuta enforces policies without using extracts. Different tools may call this feature different names (such as live connections in Tableau or DirectQuery in Power BI).

Connecting your tools directly to the compute layer without using extracts will not impact performance and provides host of other benefits. For details, see Moving from legacy BI extracts to modern data security and engineering.

Use personal credentials to authenticate and query data

Personal credentials need to be used to query data from the BI tool so that Immuta can apply the correct policies for the user accessing the dashboard. Different authentication mechanisms are available, depending on the BI tool, connector, and compute layer. However, Immuta recommends to use one of the following methods:

• Use OAuth single sign (SSO) on when available, as it offers the best user experience.

• Use username and password authentication or personal access tokens as an alternative if OAuth is not supported.

• Use impersonation if you cannot create and authenticate individual users in the compute layer. Native impersonation allows users to natively query data as another Immuta user. For details, see the user impersonation guide.

For configuration guidance, see Power BI configuration example and Tableau configuration example.

Authentication method matrix

Immuta has verified several popular BI tool and compute platform combinations. The table below outlines these combinations and their recommended authentication methods. However, since these combinations depend on tools outside Immuta, consult the platform documentation to confirm these suggestions.

Notes

• AWS Databricks + Power BI Service: The Databricks Power BI Connector does not work with OAuth or personal credentials. Use a Databricks PAT (personal access token) as an alternative.

• Redshift + Tableau: Use username and password authentication or impersonation.

• Starburst + Power BI Service: The Power BI connector for Starburst requires a gateway that shares credentials, so this combination is not supported.

• Starburst + Tableau: Use username and password authentication or impersonation.

• QuickSight: A shared service account is used to query data, so this tool is not supported.

Specify authentication method

When creating the data source in Tableau, specify the authentication method as Sign in using OAuth. This setting will allow you to use your enterprise SSO to connect to your compute platform.

Set up a live connection

After connecting to the compute platform, select the tables you will use for your data source. Then, select Live connection. This setting is required for Immuta to enforce policies.

Credential prompt

To share your dashboard to your organization, publish your data sources. During this process, set the authentication method to Prompt user. This option ensures that dashboard viewers will see the data according to their personal policies.

Resources

• Snowflake guide: https://help.tableau.com/current/pro/desktop/en-us/snowflake_oauth.htm

• Databricks guides:

  • https://help.tableau.com/current/pro/desktop/en-us/examples_databricks.htm

  • https://docs.databricks.com/partners/bi/tableau.html

  • https://learn.microsoft.com/en-us/azure/databricks/partners/bi/tableau

  • https://docs.databricks.com/integrations/configure-oauth-tableau.html

• Redshift guide: https://help.tableau.com/current/pro/desktop/en-us/examples_amazonredshift.htm

Specify authentication method

When creating a data source in Power BI, specify Microsoft Account as the authentication method, if available. This setting allows you to use your enterprise SSO to connect to your compute platform.

Set up DirectQuery

After connecting to the compute platform and the tables to use for your data source, select DirectQuery to connect to the data source. This setting is required for Immuta to enforce policies.

Publish data

After you publish the datasets to the Power BI service, force users to use their personal credentials to connect to the compute platform by following the steps below.

1. Enable SSO in the tenant admin portal under Settings -> Admin portal -> Integration settings.

2. Find the option to manage Data source credentials under Settings -> Datasets.

3. For most connectors you can enable OAuth2 as the authentication method to the compute platform.

4. Enable the option Report viewers can only access this data source with their own Power BI identities using DirectQuery. This forces end-users to use their personal credentials.

Resources

• Snowflake guides:

  • https://www.snowflake.com/blog/using-sso-between-power-bi-and-snowflake

  • https://docs.snowflake.com/en/user-guide/oauth-powerbi

• Databricks guide: https://learn.microsoft.com/en-us/azure/databricks/partners/bi/power-bi#access-azure-databricks-data-source-using-the-power-bi-service

• Redshift guide: https://aws.amazon.com/blogs/big-data/integrate-amazon-redshift-native-idp-federation-with-microsoft-azure-ad-and-power-bi