Forum Discussion
Helper IDisable "Explore Data" in PBI report
Hello All
I have one semantic model that is the source for multiple reports.
One of the user who has been given access to a report can use "Explore Data" to access other data points in the semantic model .
a) How do I disable this option to the users ?
b) Is there any way to provide access only to the report but not to the underlying semantic model ?
Thank you!
Hi zahirmohideen,
There's two options:
a) Disable “Explore data” for viewers
- Tenant-level (admin): In the Fabric Admin portal > Tenant settings, turn off the setting “Users with view permission can launch Explore” (you can also scope it to a security group). This forces Explore to require Build permission instead of just View. See Microsoft’s Explore docs: Use Explore (preview) (see the “Permissions and requirements” section).
- Per semantic model (owner): On the semantic model’s Settings page, under Explore, disable “Allow users with view permissions” so only users with Build can launch Explore. Same doc: Use Explore (preview).
- Make sure users do not have Build: Remove or don’t grant Build permission (the “Allow recipients to build content…” option when sharing a model/report/app). Build permission details: Build permission for semantic models and sharing dialog options: Share access to a semantic model.
b) Give access to the report but not to the underlying model?
- Not exactly. Sharing a report or app grants the recipient at least View permission to its semantic model (otherwise the report cannot render). Microsoft confirms this behavior here: Collaborate and share reports and dashboards.
- To limit what they can see if they use Explore (or any read path), use RLS/OLS on the model:
- Row-level security to filter rows: Row-level security (RLS)
- Object-level security to hide columns/tables: Object-level security (OLS)
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, please mark this as the solution.
2 Replies
- tayloramy
Super User
Hi zahirmohideen,
There's two options:
a) Disable “Explore data” for viewers
- Tenant-level (admin): In the Fabric Admin portal > Tenant settings, turn off the setting “Users with view permission can launch Explore” (you can also scope it to a security group). This forces Explore to require Build permission instead of just View. See Microsoft’s Explore docs: Use Explore (preview) (see the “Permissions and requirements” section).
- Per semantic model (owner): On the semantic model’s Settings page, under Explore, disable “Allow users with view permissions” so only users with Build can launch Explore. Same doc: Use Explore (preview).
- Make sure users do not have Build: Remove or don’t grant Build permission (the “Allow recipients to build content…” option when sharing a model/report/app). Build permission details: Build permission for semantic models and sharing dialog options: Share access to a semantic model.
b) Give access to the report but not to the underlying model?
- Not exactly. Sharing a report or app grants the recipient at least View permission to its semantic model (otherwise the report cannot render). Microsoft confirms this behavior here: Collaborate and share reports and dashboards.
- To limit what they can see if they use Explore (or any read path), use RLS/OLS on the model:
- Row-level security to filter rows: Row-level security (RLS)
- Object-level security to hide columns/tables: Object-level security (OLS)
If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, please mark this as the solution.
zahirmohideenThank you very much. Appreciate your quick response.