Enable options to restrict download of data to CSV format from Power BI Desktop

[dineshprabu]

Critical Vulnerability: Sensitivity Label Bypass via Power BI Desktop

Despite CSV export being disabled in Power BI Service through tenant settings, Power BI Desktop still allows data export to CSV if users have access to the PBIX file. This introduces a significant data governance gap:

1. Sensitivity Label Bypass

• Sensitivity labels do not apply to CSV exports, meaning any sensitive data exported in this format loses its protection.
• Once exported, the data can be shared externally without encryption or access controls, violating data protection policies.

2. Lack of Auditability and Tracking

• There is no reliable tracking mechanism for CSV exports from Power BI Desktop.
• Users can export sensitive data from their machines, making it invisible to centralized governance tools.

3. Inconsistent Enforcement Across Platforms

• The restriction on CSV export applies only to Power BI Service.
• Power BI Desktop remains outside the scope of tenant-level controls, creating a policy enforcement gap.
• This inconsistency undermines efforts to maintain a unified and secure BI environment.

The only available export format is CSV, which amplifies the risk by offering no native support for sensitivity labels or encryption.

Anyone with contributor level permission can perform export of PBIX files making it more vulnerable .