Issue a presentation key and replace a lost key

Someone presents Power BI reports to the board from outside the company network. Power BI can't prompt for a second-factor code, and it stores its credentials. The right key for this stays in Power BI permanently but only works during a scheduled meeting: an on-demand key. And if the person loses a key, you issue a new one with the same properties.

• Issue the key with the purpose “Präsentation auf Abruf” (On-demand presentation): read-only, no second factor, and dormant until you activate it.
• Activate it for a few hours before the meeting; the activation ends on its own.
• Reissue it if it's lost: the service never stores a key, only its SHA-256 hash, so nobody can send the same key again, not even you. A new key with the same settings replaces it, and the old one is revoked.
• Check what applies to the person, and where, with Anmeldung und Rechte … (Sign-in and permissions …).

Issue a presentation key

1. Open Personen und Schlüssel (People and keys) and select the person.
2. Choose Weitere (More) > Schlüssel (Keys) > Schlüssel ausstellen … (Issue key …), enter a label (for example, Board), and choose the purpose Präsentation auf Abruf (On-demand presentation).
3. Pass the one-time link from the message on to the person. They enter the key in Power BI as the password (authentication type “Basic”, user name pkuser; the service doesn't check the name; see HTTP: sign-in (reference), section “Personal keys” (data service documentation)).

Result: The key appears on the person's Schlüssel (Keys) tab with the state “ruht” (dormant). Any request made with it now gets 401 “ruht”.

Activate the key for a meeting

1. Expand the person's row, go to the Schlüssel tab, and select the key.
2. Choose Weitere > Schlüssel (Keys) > Schlüssel freischalten … (Activate key …) and enter the number of hours, for example 4.

Result: The state shows “frei bis 15:30 UTC” (active until 15:30 UTC). After that, the key goes dormant again on its own; Freischaltung beenden (End activation) ends it sooner. Both actions are recorded in the change log.

Replace a lost key

1. Expand the person's row, go to the Schlüssel tab, and select the lost key. If the person has only one key, selecting the person is enough.
2. Choose Weitere > Schlüssel (Keys) > Schlüssel neu ausstellen … (Reissue key …), also available on the row's shortcut menu, and confirm; the prompt names the key.
3. Pass on the new one-time link from the message.

Replace expiring keys: On the Übersicht (Overview) page, the Schlüssel laufen ab (Keys expiring) card opens the people whose keys expire within 14 days. Right-click a person and choose Schlüssel neu ausstellen …. If no key is selected, the command picks the one that expires next. Likewise, if no key is selected, Schlüssel freischalten … picks the person's only on-demand key.

Result: A new key with the same label and the same settings (read-only, no second factor, on demand, restrictions to data sources and networks) has been issued, and the old one is revoked. A new on-demand key starts out dormant, so activate it again before the next meeting.

Check what applies

Select the person and choose Weitere > Rechte (Rights) > Anmeldung und Rechte …. To the right of the list, you see, for each of the person's sign-in methods (Windows account, SQL login, each key) and each origin, whether a sign-in is allowed, needs a code, is refused, or the key is dormant, along with the rules responsible. The origins are the first two IPv4 networks named in your sign-in rules, plus “Außen” (Outside) and “Unbekannt” (Unknown); the view doesn't show IPv6 networks (see Set up a person's access by location). The service applies the same rules as for a real sign-in, except that it doesn't know about Windows groups, because it learns them only during a Windows sign-in (see the notes on that page).

• How long can a key stay active? An activation lasts at most 12 hours (field Höchstdauer einer Freischaltung (Maximum activation), Anmelderichtlinie (Sign-in policy) area, Einstellungen (Settings) tab) and never beyond the key's expiration date. Once the key reaches its maximum lifetime (365 days by default), it needs replacing anyway.
• Only administrators can activate a key, not the person themselves.
• Why not just send the old link again? The handover one-time link is used up once it's opened, and it's only valid briefly anyway (15 minutes by default, and only until the service restarts). After that, the key behind it isn't stored anywhere, because the service keeps only its hash. A one-time link sent by email is valid longer (72 hours by default) but is just as used up once it's opened (see Send an invitation by email). That's intentional: anything the service could send again, an attacker could also retrieve.

• Create a person and issue a key
• Revoke a key or lock a person
• Reference: HTTP: sign-in (reference), section “On-demand keys” (data service documentation); HTTP: administration (reference), command explain-sign-in (data service documentation)