Save a copy - Download reports

Hi sba_ur, 

Yes -this is expected. The tenant setting Download reports controls downloading PBIX/paginated files to a user’s machine, not the in-service Save a copy action. Save a copy depends on permissions (workspace role + Build on the semantic model), which is why Admins/Members/Contributors usually see it and Viewers typically don’t.

What each setting/permission does

• Download reports (tenant setting): Turns the PBIX download option on/off (File > Download this file). Disabling it blocks PBIX downloads but does not remove Save a copy.
  References: Download a report, Admin portal: Export and sharing settings.
• Save a copy (in the service/app): Duplicates the report inside the service and still points to the original semantic model (RLS respected). The option only appears if the user has Build permission on the dataset and sufficient workspace/app rights.
  References: Copy reports (Save a copy), Build permission.

How to control "Save a copy"

1. Use dataset permissions: Remove or avoid granting Build for users/groups who should not duplicate reports. No Build = no Save a copy in workspace/app.
2. Use Apps for consumption: Publish via an App and do not grant Build to the audience; also leave Allow users to make a copy of the reports in this app unchecked.
   Reference: Microsoft blog note on the App setting: Save a copy in Apps (see “Allow users to make a copy of the reports in the app”).
3. Keep workspace roles tight: Give most consumers the Viewer role in the source workspace; reserve Contributor/Member for creators.
   Reference: Workspace roles.

If this helped, please consider giving Kudos. If it answered your question, mark it as a solution.