RLS security does not apply on exported data when tested by role in Power BI Service

[prateekraina]

Hello Team,

Please log the following bug.

We have noticed that when RLS security is applied in a report and published on service, to test it we use the Test By Role option present under Datasets > Security option. 

When the report opens, it perfectly applies the security, however, when you export the data from visual, the exported data contains all the rows present in the dataset, thus completely ignoring the security mechanism.

Here is an example to repro this.

I have following sample dataset:

Now, my email address which is obfuscated has access to India Geo only.

When I go to Power BI Service, datasets > Security > Test By Role, the report loads fine showing only one entry of mine i.e for India role.

Now, when I export this data in excel, it gives me all the rows as original dataset which is totally blowing up the security part.

Please bring this into the notice of the Dev Team. This feature is very important for our customers to test security in reports before sharing sensitive data out. However, these kind of flaws really drop the confidence in them for this product.

-Prateek Raina

[Anonymous]

Hello Team,

I too am facing same issue. I have dynamic RLS created with userprinciplename() used as filter for the role. When testing this in Power BI desktop, the report gets filtered for the user and when the table visual is exported, the data.xlsx only contains data for the user for which the role is tested in "View As". But in Power BI service, when the security is tested via Test Role as for same role and User and the Table is exported, then the export doesn't apply the security and all users data is exported.

Can we expect a resolution for the same?