Power BI, PowerApps, and Microsoft Flow
Meet your organization’s compliance, security, and privacy needs with business application platform. Learn about how Power BI, PowerApps, and Microsoft Flow protect your data with a robust set of security technologies and practices.
Microsoft business application platform operates in the geographical (geo) locations listed below. To determine where customer data will be stored, customers can choose the geo of the tenant account during initial signup and creation of the account. Microsoft may replicate data to other regions for data resiliency but will not replicate or move customer data outside the geo. Customers and their end users may move, copy or access their customer data from any location globally.
Note: Microsoft continuously looks for opportunities to deploy the business application platform to more geographical locations.
The business application platform stores information that is global in nature, such as user identities and profile information, in a datacenter located in the United States. All business application customer data, as well as the geo-redundant mirrors, is maintained within the selected geo.
The business application platform works and uses several Microsoft Azure services. Please refer to the Microsoft Azure datacenter map for details on the retention of customer data by location.
Microsoft will not transfer customer data outside the selected geo except when:
- It is necessary for Microsoft to provide customer support, troubleshoot the service, or comply with legal requirements.
- The customer configures an account to enable such transfer of customer data, including through the use of the following:
- Features that are designed to operate globally, such as Content Delivery Network (CDN), which provides a global caching service and stores customer data at edge locations around the world; and the Dynamics 365 and the business application platform home page and Admin Center portals, which store application names, descriptions, and logos globally for performance.
- Common Data Service, which stores entity and field names (but not the content of database tables) globally, and uses those names to improve a Common Data Model.
- Azure Active Directory, which may store Active Directory data globally. This does not apply to Active Directory deployments in the United States (where Active Directory data is stored solely in the United States) or in Europe (where Active Directory data is stored in Europe or in the United States).
- Azure Multi-Factor Authentication, which stores authentication data in the United States.
- Services that provide global routing functions and do not process or store customer data. This includes Traffic Manager, which provides load balancing between different regions, and Azure DNS, which provides domain name services that route to different regions.
- Preview, beta, or other prerelease services, which typically store customer data in the United States but may store it globally.
Note: Microsoft does not control or limit the geos from which customers or their end users may access customer data.
Your data is secure and protected because the business application platform is built on Microsoft Azure. These services employ Azure infrastructure security which relies on best security practices and technologies to safeguard data as it travels within Microsoft datacenters and across the internet.
The architecture of business application platform services is designed to help protect your data. Business application platform services are deployed in datacenters around the world, and each deployment consists of two clusters:
- WFE cluster. All users connect to the WFE before accessing any information in business application platform services. Servers in the WFE cluster authenticate users, using Azure AD to store user identities and authorize access to data. The Azure Traffic Manager finds the nearest business application platform deployment, and that WFE cluster manages login and authentication.
- Back-end cluster. All subsequent activity and access to data is handled through the back-end cluster. It manages dashboards, visualizations, datasets, reports, data storage, data connections, and data refresh activities. The back-end cluster hosts many roles, including Azure API Management, Gateway, Presentation, Data, Background Job Processing, and Data Movement.
Users directly interact only with the Gateway role and Azure API Management which are accessible through the internet. These roles perform authentication, authorization, distributed denial-of-service (DDoS) protection, bandwidth throttling, load balancing, routing, and other security, performance, and availability functions. There is a distinct boundary between the roles that users can access and the roles that are accessible only by the system.
We work to constantly strengthen threat management to increase protection and reduce risks —so you know your data remains secure now and in the future. The Azure multi-pronged threat management approach protects business application platform services by using intrusion detection, DDoS attack prevention, penetration testing, data analytics, and machine learning.
Business application platform services are deployed in Microsoft regional datacenters. These datacenters are protected by layers of defense-in-depth security that include perimeter fencing, video cameras, security personnel, secure entrances, and real-time communications networks, continuing from every area of the facility to each physical server unit.