How to let reporting solutions safely access one isolated company / tenant data

[JonPSmith]

Willem Luijk send me a email about reporting solutions like Power BI or other analysis tools to a AuthP multi-tenant application. I thought this would be useful to other users of the AuthP library, so I created this Q&A.

The primary issue is security of the company / tenant data such that the reporting service can only access the the data of the single tenant.

[JonPSmith]

The most secure approach would be to only provide access to the tenant data that has its own database. This means you would need to set up your multi-tenant to support Sharding and make sure that the tenant data has its own database.

The downside is that a tenant having its own database is more expensive, but because AuthP's Sharding supports a Hybrid, then you only have to Shard the tenant that's want reporting, thus you can charge extra for this service.

NOTE: The "sign in and select a tenant" feature (see this section in the article called "Multi-tenant apps with different versions can increase your profits") has the ability to create a sharded tenant, but you need to build a IGetDatabaseForNewTenant (there is a demo implementation is available here to help you).

Another approach, which isn't as secure as the Sharding approach but doesn't need sharding, it to create an adapter that provides the filtered data (I think you can do that with Power BI, but I haven't done it).
This adapter would the same type of filtering that AuthP uses to control access to a tenant.

Obviously, I think the Sharding approach is the best.