Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
3 years ago
Solved

RLS doesn't work with data-export

Hi together,

 

I have faced the following issue.

One user is part of an RLS role and the role works if the user uses the report within an app on PowerBI Service workspace (visuals etc.)

But if the user does an export of data within a provided summary-table, the RLS doesn't work and the user gets all the data within the exported Excel-file.

Does anyone have the same issue or knows how to solve it?

Thank you and regards,

Andreas

Need Help
  • v-yueyunzh-msft's avatar
    v-yueyunzh-msft
    3 years ago

    Hi , Anonymous 

    Based on my research and understanding on your current issue met, the RLS can be applied to your end-user in the report viewing but lost control when your end-user export the visual to .csv/xlsx file, if I'm understanding correctly, this should be mentioned as by-design in this official documentation:

    Allow users to export data: Even users with the Viewer role in the workspace can export data if they have Build permission on the datasets in that workspace. Read more about:
    Build permission for shared datasets - Power BI | Microsoft Learn

    If you want to avoid the data lost control for the end-users with RLS restricted, here are two methods you can follow,
    One is to remove the build permission for the dataset for this end-user because they can be applied RLS as long as they are "Viewer" access to your Power BI workspace

    Another is to go to the source .pbix file of this report, disable the "Export summarized data" option for this current report and publish the report to the Power BI service again:

    Start in Power BI Desktop.

    1.From the upper left corner, select File > Options and Settings > Options.
    2.Under CURRENT FILE, select Report settings.

    3.Make your selection from the Export data section.

    Please detailed refer to this official documentation:

    Export data from a Power BI visualization - Power BI | Microsoft Learn

     

    Thank you for your time and sharing, and thank you for your support and understanding of PowerBI! 

     

    Best Regards,

    Aniya Zhang

    If this post helps, then please consider Accept it as the solution to help the other members find it more quickly

     

3 Replies

  • v-yueyunzh-msft's avatar
    v-yueyunzh-msft
    Community Support
    3 years ago

    Hi , Anonymous 

    Based on my research and understanding on your current issue met, the RLS can be applied to your end-user in the report viewing but lost control when your end-user export the visual to .csv/xlsx file, if I'm understanding correctly, this should be mentioned as by-design in this official documentation:

    Allow users to export data: Even users with the Viewer role in the workspace can export data if they have Build permission on the datasets in that workspace. Read more about:
    Build permission for shared datasets - Power BI | Microsoft Learn

    If you want to avoid the data lost control for the end-users with RLS restricted, here are two methods you can follow,
    One is to remove the build permission for the dataset for this end-user because they can be applied RLS as long as they are "Viewer" access to your Power BI workspace

    Another is to go to the source .pbix file of this report, disable the "Export summarized data" option for this current report and publish the report to the Power BI service again:

    Start in Power BI Desktop.

    1.From the upper left corner, select File > Options and Settings > Options.
    2.Under CURRENT FILE, select Report settings.

    3.Make your selection from the Export data section.

    Please detailed refer to this official documentation:

    Export data from a Power BI visualization - Power BI | Microsoft Learn

     

    Thank you for your time and sharing, and thank you for your support and understanding of PowerBI! 

     

    Best Regards,

    Aniya Zhang

    If this post helps, then please consider Accept it as the solution to help the other members find it more quickly

     

  • Anonymous's avatar
    Anonymous
    Not applicable
    3 years ago

    Hi  v-yueyunzh-msft,

    thanks a lot for your detailed explanation!

    I will check it for my use case and give you feedback afterwards.

    Best regards,

     

    Andreas

    • SRAVYA_DANDU's avatar
      SRAVYA_DANDU
      New Member
      4 months ago
      We are using dynamic Row-Level Security (USERPRINCIPALNAME-based) on a semantic model. Visuals and CSV export respect RLS correctly. However, when users export data using “Export → Data with current layout”, the exported file contains rows outside the user’s RLS scope. This appears to bypass RLS constraints.

      Any help on this?