Security of hidden columns

[maronis]

Hello, I'm creating a report that includes data from a survey of employee opinions. I want to provide department heads with a summary of the survey results, but ensure that the data stays anonymous.

To do this, I built the report in Power BI desktop and hid columns and tables with data I don't want anyone else to see (department, employee name, etc). Some of this data is necessary to calculate values shown in the report (for example, the average score by department).

So my question is - if there is a hidden column or table in the report, is there any way for a user who is not an admin/owner of the workspace to access hidden columns or tables?

Thanks so much! 

[matteoumbri]

I know it's an old post, but I'm adding just a quick note: with "analyze in excel", you build your pivot connected to the dataset. When you browse the available fields, you don't see the hidden columns and measures, but if you double-click on any cell displaying a measure in the pivot, you will cause excel to run a DRILLLTHROUGH query: it will open a new sheet showing TOP 1000 rows of the table where the measure is stored on. And that table will show all the columns, including the hidden ones(!); as far as I could see, it only does not show the calculated columns.

I don't know if the hidden columns are shown to me because I am the dataset owner, I didn't test with another account, but if they are shown to everyone able to connect to the dataset in Excel, then this is something that you need to take into account when you do considerations about security

[Greg_Deckler]

Yes. Hidden columns is not a security feature, it is to provide a cleaner interface for end users.

[maronis]

Got it, thanks. Is there any functionality to fully secure the data in a column, in the same way that row-level security can restrict access to specific rows of data?

[maronis]

Also, when I have other users test my reports, if they are not owners of the workgroup, it looks like they can't see any hidden columns and there's no way to unhide these columns or download a pbix with all the data (as far as I can tell). Is this correct? Or is it a situation where right now there's no way for non-owners to access hidden columns, but that might change in the future?

[Greg_Deckler]

If they can get to the Dataset, they can see the hidden columns. They will not see them in a Report.

[maronis]

OK, so I'm looking at the dataset right now and even for my own file, I can't see any of the hidden columns (I should note they were hidden in Desktop before the data model was published to Service) and can't see a way to unhide them.  If I hide the columns in Desktop and then publish to Service, are the hidden columns then secure?

[GilbertQ · Accepted solution]

Hi @maronis I have had a look and from my personal testing if the column is hidden in the Power BI Desktop file, there is no way to see those columns unless you have the ability to download the PBIX file.

So if the users have read-only access they will never see the hidden columns.

I tested it with the following and I could not see a column I know that I had hidden in a table.

• Edit Report in Power BI Service
• Connect to the Dataset in the Power BI Service
• Connect to the Dataset in the Power BI Service using Power BI Desktop
• Connect to the Dataset in the Power BI Service, using the Analyze in Excel 

I cannot think of any other scenario's where a user would be able to see the columns, so if anyone else thinks I have left something out please let me know.

[EJM303]

Q&A - They do appear

[maronis]

@GilbertQ Thanks so much for doing that testing! That very much aligns with what I've found when I was doing my own testing.

One follow-up question that I haven't been able to find an answer to elsewhere - who exactly is able to download the PBIX file? Are there any circumstances under which someone who is not an owner of the Workgroup would be able to download a PBIX file?

Thanks again!

[v-ljerr-msft]

Hi @maronis,

---

One follow-up question that I haven't been able to find an answer to elsewhere - who exactly is able to download the PBIX file? Are there any circumstances under which someone who is not an owner of the Workgroup would be able to download a PBIX file?

---

Members who have edit access to the report in the Workgroup can download the .pbix file from Power BI service.

In addition, if your administrator has turned off the ability to export data, this feature will not be visible in the Power BI service. 

Regards