Starting December 3, join live sessions with database experts and the Microsoft product team to learn just how easy it is to get started
Learn moreShape the future of the Fabric Community! Your insights matter. That’s why we created a quick survey to learn about your experience finding answers to technical questions. Take survey.
Hello Data Savvy people! I was hoping you could help or confirm my concerns on the below situation...
With the recent Power BI Desktop and Service updates it looks like we now have access to Shared and Certified Datasets which looks to have brought over new security privisioning in the service. I noticed all previously shared reports now have "Read, Build" permissions granted automatically to their datasets. Immediatly I disabled the new Shared Dataset feature and remove the build permissions on all of my datasets so I could vette what should and should not be shared. Interestingly enough, it was noticed that a previous report, one which users export summary data from, no longer worked in that regard. I found that the EXPORT DATA from a visualization's More Options(...) feature looks to be tied to this BUILD permission on the dataset. I bring this up becuase in some cases sharing SUMMARIZED data is fine for my customers but sharing with them the underlining data may NOT be ok. Now, if I wanted to turn on the Shared & Certified dataset feature these users would have access to start Power BI reports of their own from this dataset and potentially see sensitive information before aggregations.
Is there a way to go about setting this up to allow for the exporting of summary data from a report visualization without granting users build permissions on a dataset, basiaclly allowing them to start new reports and see underlying data?
Thanks!
Agreed that requiring build to export makes no sense. This same issue is present with paginated reports--build is required on the dataset to view the report, which in that case is even worse because you can't workaround the issue by hiding all the fields.
Totally agree with OP, this is a weird design choice. There is a idea posted that this should be separated, where you can vote on the change:
Hello,
I was just about to report this bug as well. The respective report setting does not make sense if the build permission overwrites it completly. Users with build permission can also export the detailed data even if the setting is set to "summerized data only". This acutally would be ok, since build users can connect to the data model and see the details anyways. Therefore the report setting should effect readers without build permission only. Unfortunately these users can not export any data currently.
I was about to log this exact same thing as a bug when I found your post. I also agree that it makes no sense to have to allow a user build permissions in order for them to be able to export data, it completely defeats the purpose of the build permission. Everyone in our organisation is able to export the summarised data so now we have to give everyone build permissions which is not ideal.
Thanks,
Rose
Who signed off on having build permissions as a requirement for exporting data? Now in order for someone to have a basic functionality that has been there since launch (exporting) we only need to grant them access to the entire dataset. That defeats the entire point of sharing a report and not a dataset. Well done MS.
Agree, it's surprising that this is an all or nothing setting and that it includes export to excel.
Hi @Anonymous
You could put the dataset in an App workspace, create reports/dashboards here, then publish the finished apps to large groups of people in your organization.
In this way, users can see the reports, export summary data from a report visualization, make a copy of reports in this app to their My workspace, then create their own reports based on the dataset.
Please read through this link:
Best Regards
Maggie
Community Support Team _ Maggie Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Thank you for the suggestion to implement Apps as an additional layer but this still does not solve my security concern. I am able to share through an App but the Export Data Option for a visual still requires the BUILD permissions assigned to the user on the datset to work. If I have this permission granted and the tenant setting "Use datasets across Workspaces" enabled then the user could simply start a new Power BI report in Power BI Desktop source this dataset and see the underlying data.
Why does the report allow us to specify the export of summery OR export of underlying data if this new "Use datasets across workspaces" feature is just going to circumvent that by allowing users to pull the datasets into Power BI desktop regardless.
Thanks!
Hi @Anonymous
It seems you create an new App workspace.
What i refer to is classic App workspace.
Best Regards
Maggie
Community Support Team _ Maggie Li
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
So what you are saying is that in the NEW Workspace Experience what I have experienced with the Security is the expected result. However, if I were to create a classic workspace this would be mitigated by working as designed prior to this update?
Thanks!
I have same concern and challenge with the OP, that the current setup of Build Permission is too extensive and need to find a middle ground in terms of data access permission. What I (and I assume others) need is a middle configuration where users cannot build new reports on the dataset, cannot use Analyze-in-Excel function (same as building new reports), but can still use Export to Excel based on pre-configuered visuals. This way the developer can control what data granularity is available to the consumers.
This ties in to existing requests to disable Analyze-in-Excel feature specifically, and now expands into the broader scenario of Build Permission and shared datasets.
Yes, exactly this. I would like "Export to Excel" treated separately from "Build" permission, because "Build" raises massive security concerns whereas "Export" is easy to control.
I concur that the build permissions is too extensive. There needs to be an option to allow users to read and export to Excel, without giving them permission to build their own reports.
User | Count |
---|---|
35 | |
32 | |
21 | |
11 | |
8 |
User | Count |
---|---|
54 | |
43 | |
28 | |
13 | |
11 |