What your Power BI reports share without showing
                     What your Power BI 
reports share without 
showing
Hidden tables, filtered rows and public links: why the visual 
layer is not a security boundary
A practical briefing on power bi security for data, BI and security teams
2026  |  Enterprise Data Security Research
One click can expose a dashboard and its data
Power BI makes sharing effortless. That same ease is why exposed reports are now easy to find with nothing more 
than a search engine.
Anyone 160,000+ 2 days
on the internet can view a search results returned by for Microsoft to confirm the 
report once it is published to one simple query for publicly hidden-data behavior in 
the web, per Microsoft’s published Power BI report 2024 and classify it as a 
own documentation links feature, not a bug
2 / 5
The report is a window; the model is the room
What the report shows Hidden tables Hidden columns
Charts, totals, filtered views Marked hidden, still returned by Not displayed, still fully 
the schema call queryable
What anyone with access can query Filtered-out rows Detail behind totals
Every table, column and record in the 
underlying model, through the same Removed from the view, not Raw records under every 
API the report itself calls from the model aggregate
Because Power BI shares tenants, data sources and sharing 
settings with Power Apps and Power Automate, this belongs in 
your Microsoft Power Platform security program, not treated 
as a one-off reporting quirk.
3 / 5
Hiding data is display, not access control
What teams usually rely on What actually closes the gap
Mark sensitive columns as hidden Remove them from the semantic model entirely
Filter the visual to the right subset Restrict the data source itself with Power Query
Trust the publish-to-web warning dialog Limit the tenant setting to named, trained users
Continuously inventory public and overshared 
Review sharing once, at launch
reports
4 / 5
Five steps to stop reports leaking hidden data
1 Inventory every publish-to-web embed code and widely 
shared workspace
2 Restrict the publish-to-web tenant setting to specific The bottom line
approved users
If data sits in the semantic 
3 Strip sensitive tables and columns from models instead of model, assume every viewer of 
hiding them the report can reach it. Design 
the model for the audience, not 
4 Pre-filter and pre-aggregate at the source with Power Query the visual.
5 Re-scan on a schedule, since reports and models change 
constantly
5 / 5