Export to Powerpoint "View in Power BI" Link - what permissions are applied?

[Anonymous]

When exporting to Powerpoint, the first page contains an auto-generated link for the user to "View in Power BI". 

I had assumed that this link would just direct users to the original report, where any report specific permissions would be applied. For example if a report is restricted to just 5 users, anyone else would not be able to access it even if they had the Powerpoint file with the link in it.

However, a Powerpoint generated from Power BI has been forwarded on to someone else in the organisation who did not have any explicit access to the original report. They were able to click on the link and view the report in Power BI Service, including some pages containing sensitive data which had been deleted from the slides that were circulated.

This example leads me to suspect that the default behaviour of the embedded link is analogous to the "Share with people in your organisation" option when generating a link from the report itself, i.e. that anyone with the link can view the report. 

Is anybody able to confirm that this is the case? If so it is far from ideal that the default behaviour of this link, which appears whether I want it to or not, is to override any security that has been applied to the report, without flagging this up to the person exporting the report to Powerpoint.

[Anonymous · Accepted solution]

Thanks for your reply! I have done a few tests as you suggested and I think that the error was at my end rather than any issue with the way Power BI behaves.

I think that I must have inadvertently created a sharing link that worked for everyone prior to exporting the original report to Powerpoint. As the Powerpoint contained a link to the report in it, this meant that people with the Powerpoint then had the link and could access the report. So the issue was not caused by exporting to Powerpoint, just exposed by it.

When I saw that there was a sharing link and did not remember creating it, my assumption was that Power BI had created this automatically as part of the process for exporting to Powerpoint. This has not happened in any of the tests I have carried out (i.e. there were no sharing links before I exported to Powerpoint and no sharing links afterwards). So I think we can safely file this one under user error!

[AlexisOlson]

Thanks for confirming!

[AlexisOlson]

Exporting to PowerPoint should not affect the securities and permissions of the underlying report. I'd be pretty surprised if someone were able to gain access that way.

I'm guessing this "someone else" already had access to the original report whether knowingly, explicitly, or otherwise. If not, this is a serious security hole that should be escalated. Can you reproduce the behavior in a clean, new workspace and report?