100 Chapter 4 Excel Services The Unattended Account is simply a user account created for the purpose of read-only access to data sources. The account credentials (user name and password) must be stored in the Secure Store Service (SSS). (SSS is another service application, similar to Excel Services, that stores accounts securely.) The article at http://technet.microsoft.com/en-us/library/ff191191. aspx, “Congure Secure Store Service for Excel Services (SharePoint Server 2010),” contains instructions for conguring SSS and the Unattended Account for Excel Services. Another option is to congure the Secure Store Service explicitly for credential retrieval. Basically, SSS stores credentials in a secure way that makes them available to service appli- cations like Excel Services to use for things such as data refresh. An administrator must congure it and set permissions so the right user groups have access to the credentials. A workbook author must then know the key, or Application ID, to use in the workbook to ensure that the right set of credentials is requested when the user tries to refresh the data in the workbook. So it is better than the simple “one account for everyone to refresh data on the server” approach, does have more setup overhead, but usually isn’t quite as hard to con- gure as the option we discuss next. For more information about Secure Store Service, see http://technet.microsoft.com/en-us/library/ee806889.aspx. If you want per-user security, the best option is to congure Kerberos in your environment. Kerberos conguration can be complex—and you might not need it if your users need simple read-only access via a single account. See “Conguring Kerberos Authentication for Microsoft SharePoint 2010 Products,” at http://www.microsoft.com/downloads/en/details. aspx?FamilyID=1a794fb5-77d0-475c-8738-ea04d3de1147&displaylang=en, for more informa- tion about Kerberos conguration. To congure authentication in the workbook In most deployments, the workbook author must explicitly mark which type of security option—Unattended Account (shown as “None” in the UI), SSS, or Kerberos (shown as Windows Authentication in the UI)—to use when Excel Services loads the le. If you are using a single-box deployment (and running your browser from that machine) or if you have con- gured Kerberos, the default settings are sufcient and you can skip this procedure. Use the following procedure to get an existing workbook congured to use the Unattended Account. Conguration 101 1. Start the Excel client, and open the workbook for which you want to enable data refresh on the server. 2. On the Data tab, click Connections. The Workbook Connections dialog box opens, as shown in the following illustration. 3. For each connection (only one is shown in the preceding image, but you can have more), select the connection and click Properties. 4. In the Connection Properties dialog box, click the Denition tab, as shown in the follow- ing illustration. 102 Chapter 4 Excel Services 5. Click Authentication Settings to open the Excel Services Authentication Settings dialog box, shown in the following illustration, which enables you to specify how the data connection should authenticate (and thus how Excel Services can connect to the data sources when the workbook is loaded on the server). 6. In the Excel Services Authentication Settings dialog box, select the appropriate option based on how your server has been congured. The preceding screen shot shows the None option selected, which means the server will use the Unattended Account or will use any basic authentication credentials that might be stored in the connection string. You can set these options when the data connection is created. (For example, the Authentication Settings button for Excel Services is displayed in the last screen of the data connection wizard.) Conguration 103 Also, after you congure a connection this way, that connection can be shared and reused, so not every user in your organization needs to set the conguration. The best way to do this is to store the .odc connection le in a SharePoint Data Connection Library and let your users know that they can select precongured connections from there. For more information about external data connectivity and conguration, see the following resources: ■ A downloadable document showing more details on conguring Kerberos for Service Applications (like Excel Services) in SharePoint: http://www.microsoft.com/downloads/ en/details.aspx?FamilyID=1a794fb5-77d0-475c-8738-ea04d3de1147&displaylang=en ■ A more basic webpage showing options for Conguring Kerberos in SharePoint 2010: http://technet.microsoft.com/en-us/library/ee806870.aspx ■ Details about how to congure the Secure Store Service: http://technet.microsoft.com/ en-us/library/ee806866.aspx ■ Details about conguring Secure Store Service for Excel Services and the Unattended Account: http://technet.microsoft.com/en-us/library/ff191191.aspx Locking Down Excel Files Because tight control over Excel les is a goal of many solutions, this section provides an overview of how to publish and secure server views of an Excel workbook. Excel les can sometimes contain sensitive intellectual property (IP). For example, a work- book may use custom or proprietary formulas and logic to get a result. The result may often need to be shared, and the logic may need to be protected. This kind of overall solution is very difcult to achieve in Excel natively but can be done using Excel Services. View Only Permissions The secret to sharing the workbooks while protecting the IP is to apply the View Only per- mission for users who need to view the report but shouldn’t be allowed to see any of the logic underneath. View Only permissions means that only a sanctioned application can be used to open les of a certain type. In SharePoint, Excel Services is registered as the le han- dler for the supported types of Excel les (.xlsx, .xlsb, .xlsm, .odc). Therefore, when View Only permissions are applied, only Excel Services can be used to open the Excel les. This means that users can’t use the Excel client, can’t select Save Target As, cannot download the le, and cannot open those les in any other way. The view provided by Excel Services does not expose any of the IP in the workbook. 104 Chapter 4 Excel Services Note SharePoint grants the highest level of rights possessed when deciding whether you have permissions to complete an action. This means that when you apply View Only permissions to a user who is a member of another group, such as Readers (the default), that user gets the highest level of permission granted. In this case, even though you specied View Only permissions, be- cause members of the Readers group have higher-level rights, that user can download and view the Excel le in the client, exposing the IP. The lesson here is that when you apply View Only per- missions to users, make sure they aren’t getting a higher level of access than intended because they are a member of some other group that can do more than just “view.” To apply View Only permissions You can apply View Only permissions either by making the user a member of the Viewers group or by granting the permissions to a specic user directly. The permissions can be con- gured at many different levels in SharePoint: sites, lists, document libraries, or individual documents. The following procedure shows how you can explicitly apply View Only permis- sions to a user from a site. 1. View the site in your browser, click the drop-down Site Actions arrow, and then click Site Settings. 2. On the Site Settings page, under Users and Permissions, click Site permissions. Conguration 105 3. On the Permission Tools tab, click Grant Permissions. (You can also select an existing user or group, and then click Edit User Permissions.) Clicking Grant Permissions opens the Grant Permissions dialog box. 4. In the Grant Permissions dialog box, enter the user or group for which you are setting permissions. Then expand the Add Users To A SharePoint Group (recommended) drop- down list, and select Viewers [View Only], as shown in the following illustration. Note Alternatively, if you select the Grant Users Permission Directly option, you can se- lect the View Only permission level there. 5. Click OK to save your changes. Now, when the specied users view an Excel le that has been assigned permissions in this way, they can fully interact with that le in the browser by using Excel Services, but they cannot otherwise open, access, or edit the le itself. 106 Chapter 4 Excel Services To publish an Excel le View Only permissions are especially powerful when combined with the publish capabilities in Excel. The Excel client allows a user to choose which parts of the workbook are shown on the server. The entire le is always published, or saved, to the server because it is needed to enable full recalculation and refresh actions. But the workbook author can choose to display only certain parts of the le when it is rendered by the server. View Only restricted users have access only to these portions of the workbook in the UI and through the extensibility APIs, like the JSOM or Web Service. The following procedure shows how to narrow down what is displayed in a workbook that is rendered on the server. 1. In the Excel client, click File, click Save & Send, and then click Save To SharePoint, as shown in the following illustration. 2. Click Publish Options (displayed at the top right section of the preceding illustration) to open the Publish Options dialog box. Conguration 107 The Show tab of the Publish Options dialog box controls what is shown on the server. Remember that Excel always saves the entire le; this dialog box controls only what gets displayed. By default, the entire workbook is displayed. 3. In the drop-down list, click Items In The Workbook to choose a range of sheets or to choose only specic items from the le. In the example below, only a chart and a pivot table have been selected for display. 4. Click OK to close the dialog box, and then complete the Save operation. Only the selected chart and pivot table are available on the server. Notice that the UI that allows the user to open the le is trimmed as well. 108 Chapter 4 Excel Services Create the Workbook Excel Services can be thought of as part of Excel—the part that extends the Excel-based BI story into the browser. This means that BI in Excel Services starts in Excel client. This section walks you through creating a simple workbook and then helps you save that workbook into SharePoint. This section does not provide an exhaustive list of all the BI features in Excel but does touch on a few that you can use to create an interesting report that can then be ren- dered in Excel Services. To get the data in the workbook The workbook used in the following procedure was created by connecting to the sample Contoso Retail DW database and connecting to the Sales cube. 1. To start the data connection wizard in Excel, click the Data tab, click From Other Sources, and then click From Analysis Services, as shown in the following illustration. 2. Complete the Data Connection Wizard to connect to the Contoso Retail DW database, click the Sales cube, and click Finish. Create the Workbook 109 3. In the Import Data dialog box, shown in the following illustration, select PivotTable Report to create a new pivot table report in your sheet. 4. In the PivotTable Field List dialog box, shown in the following illustration, click Sales to lter the list of elds to display only those relevant for the Sales data. [...]... To SharePoint, and then select a location or click Save As Viewing and Editing Workbooks in Excel Services 125 Viewing and Editing Workbooks in Excel Services This section provides important information about viewing and editing your Excel Services workbooks, as well as displaying your workbooks in a SharePoint dashboard Viewing Workbooks The file from the preceding section should now be saved in SharePoint. .. SharePoint 2010 Introduction As explained in Chapter 1, Business Intelligence in SharePoint, ” you can understand business intelligence (BI) as activities and practices that use fact-based support systems to improve the business decision-making process Traditionally, those fact-based support systems have often been data-driven analytics and reporting tools developed by database administrators (DBAs) and developers,... conditional formatting,” on page 04xx ■ Share workbooks broadly without requiring Excel Use Charts to show patterns and relationships See the procedure “To add a chart,” in the section “Adding Slicers.” Add Sparklines to visualize trends in small spaces For more information, see “Sparkline Overview,” on page 118 Upload or publish the workbooks into SharePoint Simply click the file in SharePoint, and use... and SharePoint After completing this chapter, you will be able to ■ Understand PowerPivot for Excel and PowerPivot for SharePoint ■ Understand how PowerPivot extends Excel functionality with Data Analysis Expressions ■ Create PowerPivot workbooks in Excel 2010 ■ Publish PowerPivot workbooks to SharePoint 2010 ■ Set up a periodic data refresh to a PowerPivot-enabled workbook in SharePoint 2010 Introduction... report At this point, you have a nice report that you can save to SharePoint To finish and save to SharePoint Before you save the report, you can use the following procedure to make the file look a little nicer by turning off the display of gridlines and headings 1 On the View tab in the ribbon, clear the Gridlines And Headings check box This turns off row and column headings, making the report look... query language for OLAP databases Similarly, PowerPivot for SharePoint integrates the SQL Server Analysis Services 2008 R2 engine with SharePoint 2010 PowerPivot for SharePoint gives users the ability to securely share, manage, and refresh workbooks stored in SharePoint, while giving IT the control necessary for managing security and learning about workbook usage When Do I Use PowerPivot for Excel?... cell containing the sparkline and type in 2007 Then adjust the size of the text, the color of the text, leftalign it, and apply any other text formatting as you please The sparkline now resembles the following illustration 4 Follow the preceding steps to create sparklines for 2008 and 2009 below your existing sparkline I chose different colors for each year, so my finished set of sparklines displays... when you are using custom-coded routines to calculate a particular set of values in a particular way They are also great mechanisms to use for performing other tasks in the system or in another system Some UDF examples I have seen include: refreshing data from a SharePoint list; writing some custom data values into a data store that are specific to the user viewing the workbook; retrieving values from... as shown in the following illustration Create the Workbook 121 4 Click the Ref Edit button on the right side of the textbox shown in the preceding illustration to expand the Create Sparklines dialog box once more, and then click OK to insert the sparkline A default blue sparkline representing the trend of data for the year 2007 is inserted into the cell you selected, as shown in the following illustration... from the workbook in xml format for further processing as part of a more advanced solution 130 Chapter 4 Excel Services The same concept works for anything that can traverse a URL and bring back data from it, including applications such as Microsoft Word, PowerPoint, or InfoPath Have you ever wondered how to get an Excel chart into a PowerPoint deck and make it refreshable—without having to copy the . single account. See “Conguring Kerberos Authentication for Microsoft SharePoint 2010 Products,” at http://www .microsoft. com/downloads/en/details. aspx?FamilyID=1a794fb5-77d0 -47 5c-8738-ea04d3de1 147 &displaylang=en,. Services) in SharePoint: http://www .microsoft. com/downloads/ en/details.aspx?FamilyID=1a794fb5-77d0 -47 5c-8738-ea04d3de1 147 &displaylang=en ■ A more basic webpage showing options for Conguring. Services Sparkline Overview Sparklines are a great new BI feature in Excel 2010 that you can use for showing large amounts of graphical data in a way that can be summarized in a single cell. To