Cannot Turn Off "Explore (Preview)" via the Tenant. Users able to build from restricted datasets

[Jon-Meakin]

Good evening,

Our users have reported seeing a new button in their Power BI Apps. 'Explore' allows them to build from the associated dataset. This presents a significant security risk and I cannot turn off the feature in the tenant. It shouldn't even be on, according to this message:

Please note, this is not the "Explore this data" feature that's been around for a while. It appears to be new.

https://learn.microsoft.com/en-us/power-bi/consumer/explore-data-service

Worryingly, the setting in the tenant suggests it will be turned on automatically after the 24/05 and yet it is on right now. I've disabled the check box as the message suggests. The feature reads as "Disabled" for the tenant.

It is not disabled. It is still working. 

Our users have very restricted access:

- Read access to the dataset 

- No access to the workspace where the dataset is held 

- No access to the workspace for the app (we separate reports from datasets) 

- Access to audience(s) within the app only. 

- We also have guest users, who can also build from Explore.
- Users can't save what they build from Explore. 

I'm more than happy for someone to point out that I've missed something really obvious. I'm only a couple of hours into this, so I could be blind to something. I don't think I have missed anything though.

Any advice would be really appreciated! 

[Jon-Meakin]

Microsoft updated us to say the bug has been fixed.

I've just tested and can confirm that users with View permissions and guest accounts cannot see the new Explore option.

We have it disabled at a tenant level, but it still appears as default for those with admin permissions. That's at least consistent with the original messages on the tenant setting.

There may be more connotations to who can see it; permissions on datasets versus members of workspaces, etc. However, my only concern was that we couldn't switch it off for our most basic users, which appears to have been addressed.

[Jon-Meakin]

Quick update for anyone keeping up with this; issue logged with Microsoft has been acknowledged as a bug affecting multiple customers. I can't see that has been made public, but you'd hope it isn't going to take long to correct. 

To confirm, whatever else you understand about this feature, it cannot be turned off at a tenant level or in the Semantic Model settings, contrary to Microsoft's own documentation. If RLS is in place, any role-level restrictions on the model still apply to the user. Otherwise, they are free to explore the model in its entirety. If they have access to a workspace, they can save the results. 

[v-pbandela-msft · Accepted solution]

Hi @Jon-Meakin,

Thanks so much for sharing this — really helpful and I’m glad you raised it.

You're absolutely right, this new "Explore" button seems to be active even when the tenant setting shows it's turned off, which doesn’t line up with the docs. It's also concerning that guest users and those with just read access through the app can still use it.

Appreciate the update that Microsoft has acknowledged it as a bug. Hopefully a fix is on the way soon. In the meantime, it's good to know that RLS still applies, but agreed — this does need more visibility.

Kindly Mark it as "Accept as solution" then community members easily find it has a bug.

Regards,
Pavan.

[Jon-Meakin]

Thank you, Pavan. Hopefully that will help others. I'll update this thread when I hear more. 

[Jon-Meakin]

After extensive testing yesterday, we logged it with MicroSoft. They have concurred with our findings. 

The feature cannot be turned off. And it shouldn't have been on in the first place. The semantic model level setting has no effect.

I'd be interested to know if anyone else has had this experience? It's a dangerous feature. Users granted view access to the dataset but no permissions on workspaces (seeing reports only via an app audience) can explore every table. RLS is the only thing that has any effect in this scenario. 

[Jon-Meakin]

We believe this is a major issue. 


I've logged it with Microsoft and awaiting a response. In summary, no change to the Tenant option or the dataset option makes any difference. Users can build from data to which they should have no access.

[Jon-Meakin]

Hi @GilbertQ 

Thank you, I hadn't seen that option. Unfortunately, so far it's having no effect.

The semantic model option was disabled altogether, because it was disabled in the Tenant Admin settings. Despite this, 'Explore' was still available. 

I enabled the Tenant level setting. This then enabled the Model level setting, and it was defaulted to Allow. I unticked it, but Explore is still available. 

Just doing some basic checks of ensuring the model is refreshed, credentials signed out, etc. BUt it still looks like this feature will not turn off. 

[GilbertQ]

Hi @Jon-Meakin 

It does look like there is now an additional tenant setting allowing you to restrict the use of the explore option. Here are more details where you can look at the additional settings where you possibly can remove the export option from when users are viewing the reports.

Use Explore (preview) in the Power BI service - Power BI | Microsoft Learn