Can't seem to disable "Analyze in Excel" export option for end users

[pbi_106]

Hi,

I have a Power BI report that uses role-based permissions to only share portions of the underlying dataset with end users.  Allowing the end users to access all of it by using Export > "Analyze in Excel" allows end users to see unfiltered data that they shouldn't be seeing, thereby circumventing the role-based permissions.  So I'm trying to disable "Analyze in Excel" (or better yet, disable all of the export options), but only for this specific report, as there are still others we might want to allow this functionality for.

I've confirmed in Power BI Desktop that, under Options > Report Settings, the "Export Data" section is set to "Don't allow end users to export any data from the service or Report Server."  The report was saved with this setting, published to the Power BI service where the end users would normally run the report, and had its data refreshed as well.  The end users permissions for both the dataset and report are set to "read".  They do not have build permissions. 

I'm using a test account with the same permissions as end users, and I can confirm that I'm not only able to "Analyze in Excel," I can also do File > Manage Permissions, something I would only expect an admin user to be able to do.  I also have the option to "Explore this data," which shouldn't be possible with only read or share permissions.

I'm at a loss as to why end users are still able to use "Analyze Excel" when they run the report, and I would greatly appreciate any help!

[v-yajiewan-msft · Accepted solution]

Hi @pbi_106 , hello @Sahir_Maharaj , thank you for your prompt reply!
Per my test, If I share the report via the workspace viewer permission, the user will not able to select "Analyze in Excel":

In addtion, if I disable the Export option for the single report, user will also not able to export data from the visual:

Please recheck the user's permissions for the workspace, semantic mode, and report, not only the direct access, also the link sharing, make sure they only have the viewer permission.
We also suggest you clear the browser cache, sign out and sign in again to compare the result.

Best regards,

Joyce

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Sahir_Maharaj]

Hello @pbi_106,

This seems to be related to a combination of tenant-level settings, permission configurations, and possibly the roles assigned in your Power BI environment.

I would start by ensuring that tenant settings in the Power BI Admin Portal restrict "Analyze in Excel" and "Export Data" (and review report/dataset permissions to avoid unintended data access)

If needed, I would recommend exploring Power BI Embedded for greater control.

Hope this helps.

[pbi_106]

The problem I see with adjusting the tenant settings is that these are global.  We may have built other reports where we might want the "Analyze in Excel" option.

[pbi_106]

Another major issue I'm finding is that users have access to "Explore this Data", despite these users' permissions at the semantic model and report level being nothing other than read and reshare.  As with "Analyze in Excel," the "Explore this Data" options appears to allow users to circumvent the role-based permissions we have in place.  Adjusting the tenant settings for the Excel options won't resolve this.