1. Power BI Embedding –Ecolab’s Story
Mark Davis
Power BI Embedding –Ecolab’s Story

2. Thank you Sponsors! Platinum Sponsor: Gold Sponsors:
Visit the Sponsor Booths
Lots of Raffle Prizes!
Get your parking paid via Sponsor Bingo
Thank you Sponsors!
Platinum Sponsor:
Gold Sponsors:

3. PASSMN – News/Info Sponsors:
Thanks to all our sponsors of 2018!
We need Sponsors for Nov/Dec 2018 and 2019!
Special thanks to our annual sponsor:
Board Member Elections in November/December:
Your chance to help out the MN SQL community!

4. November 5th Through November 9th
Join the brightest data professionals focused on the Microsoft Data Platform!
November 5th Through November 9th
Pre-Conference Sessions – Monday/Tuesday
Conference – Wednesday through Friday

5. SQLSaturday #796 – After Party
Location: 4th Floor of Mall of America Time: 6:30PM – 10PM
There will be drinks and appetizers as well as free game cards and bowling!
Hang out with some new friends you’ve made.

6. My Background Lead Developer – BI/DW -- Ecolab Career highlights6
My Background
Lead Developer – BI/DW -- Ecolab
End-to-end BI
Modeling, ETL, Reporting
De facto Embedding Guru
Career highlights
Started out my career as a software trainer, then as a BI developer and consultant for an ERP software firm.
Changed my focus to development consulting, eventually solely focused on BI.
Co-authored a book on Power View and BI Semantic Modeling.
Data warehouse engineer/architect for several years before joining Ecolab.
Linked in Profile:

7. Ecolab Overview ABOUT Ecolab SAFE FOOD CLEAN WATER ABUNDANT ENERGY7
Ecolab Overview
ABOUT Ecolab
Ecolab is the global leader in water, hygiene and energy technologies and services.  Around the world businesses in foodservice, food processing, hospitality, healthcare, industrial, and oil and gas markets choose Ecolab products and services to keep their environment clean and safe, operate efficiently and achieve sustainability goals.
CLEAN WATER
Water is the world's most valuable resource, and growing demand for clean water is putting enormous pressure on the available  supply. Water is integral to many of our customers' key processes.
SAFE FOOD
The foods we eat today come from a global marketplace. And all foods - no matter where or how they are produced - need to be handled, prepared and stored properly to prevent the growth of harmful microorganisms that can cause illness.
ABUNDANT ENERGY
Around the world, the demand for energy is growing - and meeting the demand is becoming more difficult. With innovative programs and technologies, we help energy companies extract more energy with fewer resources.
HEALTHY ENVIRONMENTS
The spread of disease can be devastating to people - and to businesses. That's why we provide healthcare facilities with comprehensive solutions that help reduce healthcare-acquired infections and improve patient safety.

8. Ecolab at a glance Size and customer base History Associates Impact8
Ecolab at a glance
Size and customer base
13.8B revenue in 2017
Nearly 3 million customer locations in more than 170 countries
History
95-year history of innovation
More than 8,700 patents
Associates
48,000 associates including:
26,500 service professionals
1,600 RD&E scientists, engineers and technical specialists
IN 2017, Ecolab HELPED CUSTOMERS:
Conserve more than 170 billion gallons of water
Save 12 trillion BTUs of energy
Clean 40 billion hands
Make 27% of the world's processed foods safe
Support clean kitchens serving 45 billion restaurant meals
Manage water and process technology enabling:
22% of the world's electricity
40% of all nuclear power
45% of petroleum products
Impact

9. Ecolab Awards Forbes America’s Best Employers Barron’s Forbes9
Ecolab Awards
Forbes America’s Best Employers
Barron’s
100 Most Sustainable Companies
Ranked #3
in Chemicals Industry
Ranked #7 in Business
Services & Supplies
Ranked #7 in Business Services & Supplies
Ranked #8
Ranked #29
2018 Gold Medal for Sustainable Development
Water A List
Ranked #2 U.S. 500 List
Ranked #43
Ranked #87
Forbes
2018 World’s Most Innovative Companies
Named Best for Vets
Employer
Ranked #93
12th Consecutive Year
2017 North America Index
4th Consecutive Year
100% Corporate Equality Index
2017 Visionary Award
Ranked #16
Ranked #30

10. Overview/Demo https://es.customer.ecolab.com/ al_rsc@demo.com
Poll group for developers, BI generalist evaluators, DBAs, other (ask them to say)?

11. The Embedding Strategy

12. The Embedding Strategy
User Base
Security and SSO
Embedded/Premium
Early Efforts
Disclaimers: This presentation is a case study. We won’t be going in depth about the SKUs, possible architectures, etc. We’re going to touch on the approach we’re taking to embed Power BI content, reasons, etc.
User Base: Customers and internal users.
Security and SSO: SalesForce logins. Synchronization.

13. Security Model Overview
What is security?
For our purposes, security is:
Restricting access to the dashboard (and its data) to ensure that users only see the data to which they should have access.
2 layers of security in global dashboard
Salesforce Portal (Single Sign-On, or SSO)
User is authenticated by Okta – Ecolab’s IDP
User must be added to a recipient rule in Portal to be able to see dashboard
Row-level security
Once access is granted to the dashboard, this ensures that data within that dashboard is restricted to only relevant data
This is done in the SSAS BI Semantic Model

14. Security Architecture New Power BI Embedded Model
Azure Web App:
Knows specific SFDC user (authenticated through Okta)
Has parameter for report (ReportID)
Has master user (authenticated through AAD) that has PBI Pro license 1 3 4
External users (not on AAD)
Azure AD 4 2 5
ECL AAD:
Master user acts as service account
Power BI:
Content must live in App Workspace; Master user must be admin of workspace
Today, PowerBI API only knows an arbitrary user -> no RLS
Future state: API call can have username & role so can pass the right data -> dynamic RLS
Steps
External logs into SFDC
Power BI 1
Notes:
RLS for Premium (expected August) is against on-prem SSAS cube
Azure AS expected by end of > change data source in report 2
User is authenticated through Okta; token passed to SFDC
SFDC Canvas calls Azure Web App; passes token and SFDC credentials to it 3
Azure Web App authenticates specific user against Okta and Master User against Ecolab Azure AD (ECL AAD) 4
Azure Web App calls Power BI API (api.powerbi.com) and report is returned, then flows through Web App to SFDC Canvas and is rendered on SFDC page for user 5

15. Row-Level Security
In the database we have loaded user access data for the purpose of restricting access by row
One example – global pest elimination data warehouse:

17. Row-Level Security Explanation
Service Address Table
Address +User XR Table
User Table
ServiceAddressKey
ServiceAddress 1
123 Main St 2
456 Pine St 3
1 Ecolab Place
ServiceAddressKey
UserKey 1 2 3
UserKey
UserName 1
John Doe 2
Jane Doe 3
Mark Davis
Combination of security tables + SQL limit who can see what
In above example, John Doe has access to 2 locations, Jane Doe & I have access to the same location
In SSAS model, we establish a role that contains a rule which limits the data that users can see:
Upper([ ])=UPPER(Username())
Displayed data will be limited to those service addresses tied to this user

18. Power BI Embedded Characteristics
Can control the user experience
Embed Power PBI in your applications
Grant outside users access without a license
Can be very cost effective for a large user base

19. Premium vs. Embedded
Power BI Premium is capacity geared toward enterprises, who want a complete BI solution that provides a single view of its organization, partners, customers, and suppliers.
Power BI Embedded is for ISVs or developers who are building applications and want to embed visuals into those applications.

20. Early Efforts Power BI Licenses Per User Early Architecture
API Evolution
Workspace Collections (Node.js and PowerShell)
Workspaces
Reports
Riding The Bleeding Edge

21. The Data

22. The Back-End On-Prem Azure SQL Server Enterprise Edition
SQL Server Analysis Services
Azure
Azure SQL Db
Azure Analysis Services

23. Architecture Matrix – Power BI Embedded
GDW
Stage
Prod
Dev
SSAS
Stage
Prod
Dev
Power BI Workspaces
Azure Power BI Embedded Capacity
Prod
Power BI Data Gateway
Integral
Dev
Azure
Pest Portal
Integral
Prod

24. The Content

25. Content – Power BI Reports

26. Embedded/Premium
We’re embedding Power BI content in a web application that is also embedded in our Salesforce-based portal.
The Embedding model allows users without Power BI licenses to access and view content.
With embedding we have a lot of control over the user experience.
Web Application

27. The Web Application
I’m going to show a little bit of code, so be warned. But it’s to give you a taste, and some URLs.

28. Pest Elimination Division Embedding Web Application
Azure Setup
Report Actions
Authentication and Embed Tokens
Embed Features
Logging

29. Azure Setup Create an Application Service (Web App)
Register the Web Application
Deploy the Application Code from Visual Studio
See:
Settings
Show pieces/steps in Azure portal.

30. Create the Web Application

31. Application Registration in Azure AD

32. Report Actions
Web Application Route address>/Home/Report public async Task<ViewResult> Report(string reportName, string languageName){ EmbedConfig embedConfig = new EmbedConfig(); …
Code which authenticates and configures embedding
Returns a View having the Power BI report in a DIV
Go to demo window again, and: Show the Div in developer tools.
Show the URL for accessing the report: Of
Show Report method.
Show Report.cshtml.

33. Authentication and Embed Tokens
Two steps of authenticating for access to content:
Azure Resource Access Token (Before you can make calls to the Power BI REST API.)
Embed Token (with data source authorization) An embed token needs to be generated which can be used from the JavaScript API. The embed token will be specific to the item you are embedding. See:

34. Embed Features (JavaScript API)
Bookmarks
Layout Options
Navigation Pane Option
Locale Settings
View Mode
Filter Pane Option
PageChanged Event Handling (Logging)

35. JavaScript API Links
General documentation: The “playground”: Everything at a high level:

36. Logging Why Not Just Use Out-of-the-box Logging?
Configure the Application for Application Logging
Configure Storage
Write Log Information
Read the Log
Power BI
Database

37. Application Logging

39. Conclusion/Wrap-Up The Back End (platform, database, RLS)
Reports and Dashboards
The Embedding Strategy (user base, SSO, embedding)
The Web Application (tokens, actions, features)
Q&A
The Back End
Platform
Database
Row Level Security
The Divisional Content – Reports and Dashboards
Power BI Reports
The Embedding Strategy
User Base
Security and SSO
Embedded/Premium
The Web Application
Authentication and Embed Tokens
Report Actions
Embed Features
Logging
Q&A