Power BI publish to web: public by design, so use with care
Publish to web in Power BI is a feature that creates a public link or embed code for a report, so anyone on the internet can view it without signing in. That suits open data and public websites. However, it is the wrong tool for anything confidential. Below are the steps, the admin controls and the safer ways to embed.
- No sign-in for viewers
- Admins can restrict it
- Never for private data
Last updated
What does Power BI publish to web actually do?
It produces a link and an HTML iFrame snippet for one report. You can place them in a blog, a website, an email or a social post. Readers then interact with the report, and they need no Power BI account.
Microsoft attaches a plain warning. Anyone on the internet can view a published report, and there is no authentication. The data behind the visuals may also be reachable, even fields the page does not display.
So treat the feature as publishing, in the full sense of the word. If the numbers could appear on a public notice board, it fits. Otherwise, choose a secure method instead.
How to create a Power BI publish to web embed code
Microsoft Learn gives this path in the Power BI service. It needs edit permission on the report.
Open the report
First, open a report you can edit in a workspace. Reports that someone shared with you do not qualify.
Choose the menu option
Then select File, Embed report and Publish to web (public). If the option is missing, ask your administrator about the tenant setting.
Confirm the warning
Next, read the notice, select Create embed code and then Publish. Stop here if any doubt remains about the data.
Copy the link or iFrame
Finally, the Success dialog offers a link and HTML. You can also set the size, the default page and a placeholder image.
Report features a public embed code does not support
Microsoft lists these among the limitations, so check a report against them before you plan a public page.
- Reports that rely on row-level security
- DirectQuery and live connection sources
- A shared model in another workspace
- R and Python visuals
- Paginated reports
- Exporting data from the visuals
How do administrators control Power BI publish to web?
A Power BI administrator decides whether the feature exists at all. The setting sits in the Admin portal, under Tenant settings, in the Export and sharing settings group. It can apply to the entire organization or to specific security groups.
We suggest a short, named group. Then only trained people can create codes, and everyone else sees no option. Also, Microsoft requires a Pro or Premium Per User license and edit rights on the report for the person who publishes.
Existing codes stay visible. In a workspace, the settings gear opens Manage embed codes. From there you can retrieve a code or delete it, and deleting it breaks every link that used it. Each code also shows a status, such as Active or Blocked.
What should you use instead for confidential reports?
Microsoft points to two secure choices. The Embed option places a report in an internal website or portal, and viewers must sign in. Embed in SharePoint Online does the same for SharePoint pages. Both respect the permissions on the report.
Freshness is another reason to look elsewhere. A public report serves cached data, and Microsoft says changes can take around an hour to appear. Therefore it is a poor fit for figures that move often.
Heavy traffic has a cost too. Microsoft notes that very high usage can temporarily block viewing. So a report meant for a large public audience needs a plan, and perhaps a different hosting approach. For secure embedding in your own app or portal, see Power BI embedded.
Public embed code questions from report owners
Is Power BI publish to web secure?
No, and Microsoft says so directly. A published report has no authentication, so anyone with the link can open it. They can also pass the link on. Even data that a page does not show may be reachable through the model. Therefore use it only for information you would hand to the public, and use secure embedding for everything else.
Why is the publish to web option missing in Power BI?
Usually the tenant setting is off for your account. An administrator can enable it for the entire organization or for specific security groups. It can also be absent because the report does not qualify. For example, reports shared with you, reports with row-level security and paginated reports cannot use it. Ask your administrator first, then check the report.
How do we remove a public report?
Open the workspace, select the settings gear and choose Manage embed codes. Find the report and delete its code. After that, every link and iFrame built on the code stops working. Because copies of the data may already exist elsewhere, removal limits further exposure but cannot undo what people saw. So review reports before publishing, not after.
Do viewers need a Power BI license?
No. Microsoft states that viewers do not need to be Power BI users. That is the point of the feature, and also its risk. The person who creates the code does need a license and edit permission. In addition, that person must keep access to the report, since the code depends on its creator.
Can you check whether our tenant has public reports?
Yes. Power BI Agency reviews embed codes, tenant settings and sharing habits as part of a governance check. We work online inside your own tenant and report findings in writing. The team is small and experienced, part of Sataware Technologies, and independent of Microsoft. Start with a free 30-minute assessment. We answer within 2 hours.
Let's build your first dashboard together.
Tell us what you report on today. A consultant replies within 2 hours with next steps.
Trusted partners
Microsoft Solutions Partner · AWS Partner
Cloud & AI Platforms
Azure SQL, Microsoft Fabric and the data pipelines behind your reports.
AI Business Solutions
Power BI reporting on your Dynamics 365, Business Central and Power Platform data.
Security
Row-level security and Entra ID sign-in on every report and workspace.
Amazon Web Services
Power BI on your AWS data, with connectors for Redshift, Athena and S3.