🔒 Security and Access Control

This section covers everything that controls who can access PowerConnect, how they authenticate, and how their data access is scoped — from the choice between Anonymous and OAuth2 connections, through TM1 credential management, to gateway authentication for the Power BI Service.

What you'll find in this section

Security

The fundamental choice between Secured (OAuth2) and Non-Secured (Anonymous) PowerConnect connections, why Row Level Security (RLS) is still needed even with OAuth2, and how Power BI Service refreshes interact with the Data Gateway user.

Why it matters: choosing the right connection mode is the single biggest security decision you'll make with PowerConnect. This article explains the trade-offs so you can pick the right one for trial, POC, and production.

Setting the TM1 credentials

How PowerConnect stores TM1 administrator credentials in the Windows Credential store, and how impersonation enforces TM1 security from Power BI Desktop after the initial connection.

Why it matters: this is the foundation that lets users see only their TM1-allowed data in Power BI. Getting the admin connection and impersonation right is what makes TM1 security flow through to Power BI viewers.

How to configure the Gateway connection in PBI Service

Step-by-step setup for a new connection in Manage Connections and Gateways, using OAuth2 as the authentication method.

Why it matters: this is what lets the Power BI Service refresh data securely against your TM1 instance through the on-premises Data Gateway — both on demand and on a schedule.

Summary

PowerConnect security has two halves: choosing the right connection model (Anonymous vs OAuth2 plus RLS), and configuring the supporting plumbing — TM1 admin credentials and the Power BI Service Gateway. The articles in this section cover both, so a production-ready deployment is a configuration exercise rather than a research project.