Allowed link destinations for a self-hosted deployment
When a report tracks link clicks, a link that a viewer selects goes through the BI Pixie event address on its way to the website. When you deploy BI Pixie on Azure, the Allowed link destinations (optional) field at the end of the Network tab can limit which websites those links may open. By default the field is empty, and links open to any website.
Who this is for
This setting is for organizations whose security team does not want a service in their subscription to send a viewer to any website on the internet. If your reports link only to a known set of websites, listing them makes sure the event address can never send a viewer anywhere else.
The field is offered from version 1.3.0 of the deployment template, only when the deployment creates new Function Apps.
What it costs
Nothing. The list is a setting on the Function App that receives Pixie events.
What changes for viewers
A link to a website on the list opens as before, and the click is counted. A link to any other website shows a page saying the link cannot be opened, and the click is not counted. A link that hides its real destination behind unusual characters is refused the same way.
What to prepare
The list of websites your reports link to. Enter them one on each line. A list separated by commas also works. For example:
contoso.com
https://contoso.com/app- A website name, such as
contoso.com, allows that website and its subdomains, such asfinance.contoso.com. - An address, such as
https://contoso.com/app, allows that address and the pages under it, such ashttps://contoso.com/app/sales, but nothttps://contoso.com/application. - The whole list must be shorter than 4,000 characters and cannot contain quotes or angle brackets.
The list cannot be changed after the deployment, so it is worth settling with your report authors before you start.
After the deployment
The list covers every report you add Pixies to with bi-pixie.exe, because their link clicks go through the event address you enter in pixies_flow_endpoint_url. See Add Pixies to your reports.
From version 1.7.0 of the deployment template, BI Pixie can also open links only from the reports you added Pixies to with link tracking on. When you use both, BI Pixie opens a link only when its report tracks link clicks and its website is on the list. See Limit links to the reports that track them.
The list is chosen when BI Pixie is installed. A Managed App cannot change it afterwards, because Azure keeps the resources in its managed resource group read-only for you, their application settings included. Changing the list takes a new deployment.