How to stop overriding report level filter on service?

[visheshjain]

Hello Everyone,

I have a report on which I have added a report level filter to filter out a column, so it is working on each and every visual of the report. This report level filter is locked and invisible to everyone.

I have published the report to the service but MS has introduced some new feature, 'export this data'.

In this you have the option, when exporting data you have the option to remove/override the 'report level filters'.

I would like the report level filters to stay intact, even when using the 'export this data'

My last option will be going to Power Query and filtering out the data, but setting this up will be a tedious process and this will slow down my refreshes as well.

The other ID accessing the report has 'Contributor' status, which is enabled so that they can refresh the data on their own.

Is there any way I can filter out the data, so that it is not visible on the service OR can we stop this overriding of the filters on the service?

Thank you,

Vishesh Jain

[v-csrikanth]

Hi @visheshjain 
Sorry for the late response.

Here you can find the detailed steps to resolve your issue.

1. Since RLS works as expected in Viewer role, keep using that for actual user access — it’s the cleanest enforcement for row-level filters and doesn’t require changing measures.

2. You're right not wanting to modify every measure. Instead of applying filters in measures or relying solely on report-level filters (which "Export This Data" ignores), move your filters into the model using RLS rules or table-level filters (like calculated tables or filtered views), so the data isn't even available unless needed.

3. For PA (Power Automate):
   You can build a flow triggered from Power BI (button or scheduled) that:

   • Connects to the dataset via Power BI connector.

   • Applies filters in the flow.

   • Exports the filtered table as Excel/CSV.

   • Sends it via email or stores in OneDrive/SharePoint.
     This gives full control over what gets exported and when.

4. “Export this data” preview cannot yet be fully governed like the old export options.

5. The best you can do is use RLS to filter rows for the Viewer and use Object-Level Security (OLS) to block sensitive columns, so even if a user exports, they don’t see restricted fields.

6. You do want users to export filtered data — so combine:

   • RLS for row filtering.

   • OLS for column filtering.

   • Viewer role to ensure enforcement.

   • Optional: Power Automate for controlled, repeatable export flows if “Export this data” is too open.

This setup avoids rewriting all measures and protects both row and column-level access.

If the above information is helpful, please give us Kudos and mark the response as Accepted as solution.
Best Regards,
Community Support Team _ C Srikanth.

[visheshjain · Accepted solution]

Hello @v-csrikanth,

Thank you for your response, but I have reached a solution to filter out the data from the data source itself.

Not the most elegant solution, but the only one that seems to working in my case.

RLS will not work as the user's role is a contributor and RLS works only with Viewer role.

Object Level Security is not required as I want the user to be able to export the column but just not the whole column.

Please can you confirm for me that if Object Level Security works with contributor role or not.

Thank you,

Vishesh Jain

[v-csrikanth]

Hi @visheshjain

Yes, It is correct that RLS does not apply to workspace Admins, Members, or Contributors.

1. To properly test RLS, ensure you are assigned the Viewer role in the workspace and then verify the data restrictions as you mentioned above.
2. Instead of merging, use relationships between tables and create DAX measures to dynamically filter data without physically merging tables.
3. If users must extract data while maintaining security, consider:
• Using PA to create a controlled export process.
• Restricting export of underlying data in Power BI Service → Report Settings → Export Data.
• Applying Object-Level Security (OLS) to restrict sensitive columns from being exported.

If the above information helps you, please give us a Kudos and marked the Accept as a solution.
Best Regards,
Community Support Team _ C Srikanth.

[visheshjain]

Hi @v-csrikanth,

Option 1 - Yes tried it with the Viewer role and yes it is working.

Option 2 - I have relationships created between Dim and Fact tables and until now I was filtering the Dim table using the report level filters.

I do not want to change every single measure, as I have less tables than measures and filtering table at the source, would be less tedious than measure.

If I create a measure and add it to the report level filter, the problem still persists.

Option 3-

3.1 - What is PA and please can you elaborate on how to execute this.

3.2 - Any changes to 'export data' does not disable the 'export this data' preview feature.

3.3 - I want users to be able to export filtered data.

Again, really appreciate your prompt responses!

Thank you,

Vishesh Jain

[v-csrikanth]

Hi @visheshjain 

​In Power BI, when users export data from a report, they have the option to remove or override report-level filters, which can lead to unintended data exposure.To ensure that your report-level filters remain enforced during data export, consider the below approaches:​

1. Implement DLS roles within your dataset to restrict data access based on user attributes. This ensures that users can only view and export data permitted by their role, regardless of any filters they attempt to override.
2. Define RLS roles to control data visibility at the row level. By assigning users to specific roles, you can enforce data restrictions that persist during report viewing and data export.
3. Filter and transform your data during the data preparation phase in Power Query.
4. Adjust the export settings in the Power BI service to restrict or disable the ability to export underlying data. This can be configured in the report settings under "Export Data.

If the above information helps you, please give us a Kudos and marked the Accept as a solution.
Best Regards,
Community Support Team _ C Srikanth.

[visheshjain]

Hi @v-csrikanth,

Thank you for taking the time to respond!

Earlier on when exporting the data there was no option to remove the filters, unless the filters were visible and unlocked on the filter pane.

The report/visual level filters could not be removed if they were hidden and locked.

It is with this new feature 'export this data' which you can see is different from the usual 'export data', that MS has decided to allow report viewers to remove those filters put in place by the report author.

We could go on, but that's a debate for a different day/thread.

As for options 1&2, I am trying to execute that, but for some reason, RLS is not working and I have setup RLS multiple times before. Please can you confirm if RLS works on report authors as well or not?

I have created a role and assigned myself to it on the service to test it out, yet I am able to see all the data.

Option 3, is one of my last options as I would have to merge multiple fact tables with the DIM table and this will slow down the query, not to mention the process is quite tedious.

Option 4 is not feasible, users want to extract data.

Please let me know if you have any further information/suggestions.

Thank you,

Vishesh Jain

[Deku]

RLS does not apply to workspace Admins.

To test you in Power BI desktop you use  the "View As" feature under the Modeling tab allows you to simulate how a report would appear to a user with a specific role.

You can also do this in the service.

https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security#validating-the-ro...

[visheshjain]

Hi @Deku,

Thank you for your response!

As mentioned in my question too, the other user has a Contributor status, so that they are able to refresh the reports on their own.

Apart from removing the data from PQ, is there anything else that can be done from a RLS perspective or any other solution?

Thank you,

Vishesh Jain

[Deku]

Is the source has a query engine, filtering out rows or removing columns will improve refresh times, as long as the query folds.

Another option would be static row level security that would remove the rows, and you apply it to everyone

[visheshjain]

Hello @Deku,

Thank you for your response! I am using AWS Athena as the data source, so the query is not folding and yes my last option is to filter out data from there but that would require rewriting and merging multiple queries so, too much to do!

I have a DIM table and a fact table and I have simply put the report level filter on the DIM table, but the new 'export this data' overrides those filters.

RLS seems to be a feasible option, but that would require managing groups at the M365 level.

If you have any other suggestions, I am all ears and again thank you for taking the time to respond!

Vishesh Jain