Forum Discussion
Export Data from Visual without Build Permissions
Hello Data Savvy people! I was hoping you could help or confirm my concerns on the below situation...
With the recent Power BI Desktop and Service updates it looks like we now have access to Shared and Certified Datasets which looks to have brought over new security privisioning in the service. I noticed all previously shared reports now have "Read, Build" permissions granted automatically to their datasets. Immediatly I disabled the new Shared Dataset feature and remove the build permissions on all of my datasets so I could vette what should and should not be shared. Interestingly enough, it was noticed that a previous report, one which users export summary data from, no longer worked in that regard. I found that the EXPORT DATA from a visualization's More Options(...) feature looks to be tied to this BUILD permission on the dataset. I bring this up becuase in some cases sharing SUMMARIZED data is fine for my customers but sharing with them the underlining data may NOT be ok. Now, if I wanted to turn on the Shared & Certified dataset feature these users would have access to start Power BI reports of their own from this dataset and potentially see sensitive information before aggregations.
Is there a way to go about setting this up to allow for the exporting of summary data from a report visualization without granting users build permissions on a dataset, basiaclly allowing them to start new reports and see underlying data?
Thanks!
13 Replies
Who signed off on having build permissions as a requirement for exporting data? Now in order for someone to have a basic functionality that has been there since launch (exporting) we only need to grant them access to the entire dataset. That defeats the entire point of sharing a report and not a dataset. Well done MS.
Agree, it's surprising that this is an all or nothing setting and that it includes export to excel.
I was about to log this exact same thing as a bug when I found your post. I also agree that it makes no sense to have to allow a user build permissions in order for them to be able to export data, it completely defeats the purpose of the build permission. Everyone in our organisation is able to export the summarised data so now we have to give everyone build permissions which is not ideal.
Thanks,
Rose
Hello,
I was just about to report this bug as well. The respective report setting does not make sense if the build permission overwrites it completly. Users with build permission can also export the detailed data even if the setting is set to "summerized data only". This acutally would be ok, since build users can connect to the data model and see the details anyways. Therefore the report setting should effect readers without build permission only. Unfortunately these users can not export any data currently.
Totally agree with OP, this is a weird design choice. There is a idea posted that this should be separated, where you can vote on the change:
Agreed that requiring build to export makes no sense. This same issue is present with paginated reports--build is required on the dataset to view the report, which in that case is even worse because you can't workaround the issue by hiding all the fields.
Hi Anonymous
You could put the dataset in an App workspace, create reports/dashboards here, then publish the finished apps to large groups of people in your organization.
In this way, users can see the reports, export summary data from a report visualization, make a copy of reports in this app to their My workspace, then create their own reports based on the dataset.
Please read through this link:
Best Regards
MaggieCommunity Support Team _ Maggie Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.Thank you for the suggestion to implement Apps as an additional layer but this still does not solve my security concern. I am able to share through an App but the Export Data Option for a visual still requires the BUILD permissions assigned to the user on the datset to work. If I have this permission granted and the tenant setting "Use datasets across Workspaces" enabled then the user could simply start a new Power BI report in Power BI Desktop source this dataset and see the underlying data.
Why does the report allow us to specify the export of summery OR export of underlying data if this new "Use datasets across workspaces" feature is just going to circumvent that by allowing users to pull the datasets into Power BI desktop regardless.
Thanks!
Hi Anonymous
It seems you create an new App workspace.
What i refer to is classic App workspace.
Best Regards
MaggieCommunity Support Team _ Maggie Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
