Power Automate – Export PBI Thin Report (Shared Semantic Model) with Dynamic RLS- Supported or Not ?

[Pravanjan]

Hi Fabric / Power BI Community,

I’m looking for official clarification on exporting Power BI reports using Power Automate when shared semantic models (thin reports) and dynamic RLS are involved, as I am seeing conflicting guidance.

My setup: -

- A common Power BI semantic model (dataset) hosted in Power BI Service

- Dynamic RLS implemented using USERPRINCIPALNAME()

 - Multiple thin reports built on top of this semantic model

- Thin reports published across different workspaces

- All workspaces are on Premium / Fabric capacity

Requirement: I want to use Power Automate -> Export to File for Power BI Reports (PDF) and email each user such that:

- Each user receives only their own data

- Row-level security is fully respected during export

The confusion: In Microsoft documentation and community answers, the term “live connection” seems to be used for different scenarios.

Some references say that reports using live connections are not supported by the Export to File API.

Other references and examples suggest that thin reports built on shared Power BI semantic models are supported, and that RLS can be enforced by passing user identity during export.

Since thin reports technically use a live connection to a semantic model, it is unclear whether:

- Shared Power BI semantic models (thin reports) are officially supported by the Export to File API

- Or whether the “live connection not supported” limitation applies only to external models such as Azure Analysis Services or SSAS

Specific questions:

1. Is exporting thin reports built on shared Power BI semantic models supported by the Export to File API?
2. Does the “live connection not supported” limitation apply only to AAS/SSAS, or also to Power BI shared semantic models?
3. When using dynamic RLS, is looping per user in Power Automate and passing the user’s UPN the only supported pattern?
4. Is there official Microsoft documentation that clearly distinguishes these scenarios?

I want to ensure that the approach used is fully supported and does not risk data exposure or future breaking changes.

Thanks in advance for any clarification or official documentation.

[cengizhanarslan · Accepted solution]

1) The Export to File for Reports API fully supports thin reports connected to shared Power BI semantic models.

2) The limitation applies only to external Analysis Services connections — Azure Analysis Services and on-premises SSAS via live connection. A thin report pointing to a Power BI semantic model within the same tenant is treated as a native Power BI connection, not an external live connection, and is fully supported by the export API.

3) Yes, for dynamic RLS based on USERPRINCIPALNAME() this is the correct and only supported pattern. The API accepts an effectiveIdentity parameter where you pass the target user's UPN. The export engine then evaluates RLS as that user and returns only their permitted data. But you need to parameterize UPN otherwise it would use your own credential which probably would break RLS configuration.

Alternatively, you could use dynamic subscriptions instead of power automate which is probably the easiest way to do. 

https://learn.microsoft.com/en-us/power-bi/collaborate-share/power-bi-dynamic-report-subscriptions 

[tayloramy]

Hi @Pravanjan, 

Power Automate can't impersonate your users, so it cannot generate an export that respects RLS for each user, instead Power Automate will likely use your credentials, which can probably see all data. 

What I recommend is using the filter options to filter before each export. 

See this thread for more details: Solved: Using a filter on PDF Export in Power Automate - M... - Microsoft Fabric Community

[andrewsommer]

1. Yes
2. The limitation applies to external semantic models, specifically; SQL Server Analysis Services (SSAS) and Azure Analysis Services (AAS).  The export API cannot impersonate users across external engines or enforce RLS security across service boundaries. 
3. Yes, the safest pattern is loop per user + pass identity. 
   1. In Power Automate:
      1.       Iterate over users
      2.       Call Export to File for Power BI reports

•       Use the EffeciveIdentity (or “userbame) field in the connector)

1.       Set it to the user’s UPN

4. As always MS documentation is a bit fragmented and you have to piece it together from multiple places but you should find your clarity in MS saying that Power BI datasets are supported and Live connections are not supported; think of Power BI datasets as internal and live connections being external.