CRITICAL ISSUE (data breach) on PowerBI service for paginated reports connected to AAS cubes

[rajeevshah]

Hello friends,

We are using AAS cubes. We also have setup Azure B2B users and have shared the PowerBI portal (BI reports) to the extended organization. We have Role based authentication (RBA) setup, so that each of the extended org can see only their data.

since the past week, this has stopped working on paginated reports on the service. It does not respect RBA.

If one downloads the PBRS report and connects using the Azure B2B id, it respects, but the moment it is published to the portal, it ignores RBA.

This causes a data breach as anyone can see everyone's data. We have had to remove all the paginated reports published on the portal to mitigate the issue.

Just wondering if anyone else has faced this ?

[GilbertQ]

Hi @rajeevshah 

Could I ask why you are not using Row Level Security? This will ensure 100% that the data that they see is 100% secure. If they are not in a role they do not se anything.