Restrict Export Data for Power BI Report Embedded in SharePoint Online Using Security Groups

The key point is that the SharePoint Power BI web part does not independently control Power BI export permissions.

When you embed a report using File → Embed report → SharePoint Online, users are still viewing Power BI content, and the embedded report respects Power BI item permissions and data security such as RLS. Embedding the report in SharePoint does not automatically grant Power BI access; users still need access to the report/app in Power BI. 

So for your questions:

1. Do the Entra ID security groups need to be added to SharePoint?
   Only if you want to control who can access the SharePoint page itself. For controlling Power BI export data, use the groups in the Power BI/Fabric Admin portal tenant setting. SharePoint permissions control access to the page; Power BI permissions and tenant settings control Power BI actions. 

2. Do you need SharePoint-specific groups?
   No, not for Power BI export control. You can use Microsoft Entra ID security groups directly in Power BI/Fabric tenant settings. Tenant settings support enabling a feature for specific security groups and excluding specific groups; the most restrictive setting applies. [

3. Will the Export data tenant setting apply when viewed through SharePoint Online?
   Yes. The report is still a Power BI report, even though it is displayed inside SharePoint. The SharePoint web part is not a separate export-security layer. Configure the Export data setting in the Power BI/Fabric Admin portal. , https://learn.microsoft.com/en-us/power-bi/collaborate-share/office-integration/service-embed-report-spo

Recommended setup:

1. In Microsoft Entra ID, create or use these groups:

   • PowerBI_Export_Allowed
   • PowerBI_Export_Denied

2. Add users who should export data to PowerBI_Export_Allowed.

3. Add users who should not export data to PowerBI_Export_Denied.

4. In Power BI / Fabric Admin portal, go to:

   Admin portal → Tenant settings → Export and sharing settings → Export data

5. Set it to one of these patterns:

   Option A — allow only Group A

   • Enable export data for a specific security group.
   • Add PowerBI_Export_Allowed.

   Option B — allow Group A but explicitly block Group B

   • Enable export data for specific groups.
   • Add PowerBI_Export_Allowed
   • Add PowerBI_Export_Denied as an excluded group, if your tenant setting configuration allows exclusions.

   Tenant settings can be enabled for specific groups, enabled except for certain groups, or enabled for specific groups except excluded groups, and the most restrictive setting applies. 

6. Also check the report-level export setting:

   • In Power BI Desktop / Service, make sure the report allows the export type you want, for example summarized data only or summarized + underlying data. Power BI export also depends on report/designer controls and the user’s permission to the data. 

One important note: the tenant setting controls the Power BI UI export feature. Microsoft also notes that tenant settings are governance controls, not a complete security boundary on the semantic model itself. If users have access to query the semantic model through other methods, you should also review semantic model permissions, Build permission, app permissions, RLS, and sensitivity labels

🔍Parchitect
Solutions Architect · Microsoft Fabric Specialist

💡Helpful? Kudos are appreciated.
✔️Solved? Mark as Solution so others can find it faster.