Subject: Restricting "Explore" Option in Power BI Service Despite RLS – Need Help

[Schorsch]

Hello everyone,

I'm currently facing a challenge and would really appreciate your input.

I’ve built a report for our company’s different sites and implemented Row-Level Security (RLS) so that each site manager can only see data relevant to their own location. The RLS setup works as expected — users can only view their assigned data when opening the report in the Power BI Service.

However, the issue is that users still have access to the "Explore" feature (see screenshot), which allows them to browse the underlying dataset (see screenshot) — something I want to prevent.

Here’s what I’ve already tried:

In Power BI Service:

• Configured access permissions

• Adjusted security settings within the semantic model

In Power BI Desktop:

• Defined roles properly using RLS

• Ensured all users only have view permissions

Despite these precautions, the "Explore" option still appears and gives users access to broader data views than I’d like.

Is there a way to disable or restrict this feature, or have I missed something in the permissions setup?
I’d be very grateful for any tips or guidance.

Thanks in advance!
Best regards,
Schorsch

[mark_endicott]

@Schorsch - There's no screenshot, but it sounds to me like you have set something up incorrectly with your Security and Permissions. 

I would use an App and only provide users access to the app, not the workspace. You will then have to allocate them separate "view" permissions to the semantic model on the service. 

I actually keep all semantic models in a separate "locked down" workspace where there are no reports. This allows me to control all model access from one workspace that no one has access to.

If I answered your question please mark my post as the solution, it helps others with the same challenge find the answer!

[Schorsch]

Hello @mark_endicott , yes, i l´ve got it.

[Schorsch]

I even created a new report with only two data entries on purpose. The problem is always the same. The user can access the individual data entries via the 'Browse = Durchsuchen' button.

[mark_endicott]

@Schorsch - But have you given them access to a workspace or a app?

Even if the Explore button through the app allows access to the model tables, the RLS will still be in place. 

If I answered your question please mark my post as the solution, it helps others with the same challenge find the answer!

[Schorsch · Accepted solution]

@mark_endicott  I distributed the report via the app.

[Schorsch]

there the users are set as viewers

[mark_endicott]

@Schorsch - Well if your RLS is working correctly, then you users should not be able to see data through this view that they should not. 

You could use OLS (through tabular editor 2) to obscure particular columns or tables that you dont want them to see too. https://learn.microsoft.com/en-us/fabric/security/service-admin-object-level-security?tabs=table

If I answered your question please mark my post as the solution, it helps others with the same challenge find the answer!

[vojtechsima]

Hello, @Schorsch ,
How do you share your report with the users?

Make sure they are just Viewer, or use Power BI App (publish via App), because if they have Build permission they can see the explore stuff.

[Schorsch]

The report is shared via the Power BI app. The user only has "Viewer" permission.