Forum Discussion
Power BI Apps without Explore Tab
Hi!
I'm designing a Power BI report app to show users a set of survey measures. The report has two types of information:
A personal section, where each user (identified by email) can see only their own answers.
A general section, where overall averages are calculated using the full dataset.
The personal section is implemented with the USERPRINCIPALNAME() function to filter answers per user. This works as expected.
However, I’ve run into a problem when sharing the app. The data is sensitive, so each user must only see their own detailed data, while the global averages should still be calculated over all responses. I’ve managed to get the calculation side working, but inside the app an “Explore” tab is available, and from there any user can see the full dataset, not just their own records.
For the test user:
They are assigned the Viewer role in the Power BI workspace.
In the app settings, “Allow people to build content with the datasets in this app audience” is unchecked.
Despite this, the user can still use Explore to access all the data.
Is there any way to disable or further restrict Explore so that users cannot see the full dataset, while still using all records to calculate the overall averages?
Note: I’ve already tried Row‑Level Security (RLS), but with RLS enabled the averages cannot be calculated in the way I need, so RLS is not an option in this scenario.
1) Apply RLS so users only ever see their own rows
2) Precompute global averages in:
- Power Query
- SQL
- Dataflow
3) Store them in a separate table not affected by RLS
4) Use that table for the “global averages” visuals
You apply RLS so users can only ever see their own detailed rows, which fully protects the dataset from Explore, exports, and other access paths. Global averages are then calculated upstream (in SQL, Power Query, or a dataflow) and stored in a separate, pre-aggregated table that is not affected by RLS. That table is used exclusively for overall or benchmark visuals, while the RLS-protected table is used only for personal views. This clean separation between secure detail data and safe aggregated data is the only supported way to meet both privacy and reporting requirements.
2 Replies
1) Apply RLS so users only ever see their own rows
2) Precompute global averages in:
- Power Query
- SQL
- Dataflow
3) Store them in a separate table not affected by RLS
4) Use that table for the “global averages” visuals
You apply RLS so users can only ever see their own detailed rows, which fully protects the dataset from Explore, exports, and other access paths. Global averages are then calculated upstream (in SQL, Power Query, or a dataflow) and stored in a separate, pre-aggregated table that is not affected by RLS. That table is used exclusively for overall or benchmark visuals, while the RLS-protected table is used only for personal views. This clean separation between secure detail data and safe aggregated data is the only supported way to meet both privacy and reporting requirements.