# Restrict permissions in roles to not download data table visualization CSV

**URL:** <https://discuss.elastic.co/t/restrict-permissions-in-roles-to-not-download-data-table-visualization-csv/319711>\
**Category:** Kibana\
**Created:** [November 24, 2022, 7:57am UTC](https://discuss.elastic.co/t/restrict-permissions-in-roles-to-not-download-data-table-visualization-csv/319711 "2022-11-24T07:57:32Z")\
**Posts on this page:** 4\
**Page:** 1

<div class="post-metadata">

**Author:** ![Sandeep\_Raju](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Post date:** [November 24, 2022, 7:57am UTC](https://discuss.elastic.co/t/restrict-permissions-in-roles-to-not-download-data-table-visualization-csv/319711/1 "2022-11-24T07:57:32Z")

</div>

Hi,  
I'm Using Kibana 7.10.0

Is there a way(role) to show Dashboard/Visualization & user should not download CSV of the data table visualization ?

I'm having dashboard with data table visualizations.  
I have tried different permissions for my custom roles for user.  
But I can't restrict Download CSV option ( Both Raw & Formatted).

I can give a role , but User cannot see visualization/Dashboard.  
I want to give him option to see visualization, but not download CSV option.

 ![Screenshot 2022-11-24 at 1.31.38 PM](https://us1.discourse-cdn.com/elastic/original/3X/4/c/4c314a51e3917c3bd5eaa3950c8e6a77e3a51584.png)

---

<div class="post-metadata">

**Author:** ![ppisljar](https://sea2.discourse-cdn.com/elastic/user_avatar/discuss.elastic.co/ppisljar/32/11588_2.png) [@ppisljar](https://discuss.elastic.co/u/ppisljar)\
**Post date:** [November 24, 2022, 10:02am UTC](https://discuss.elastic.co/t/restrict-permissions-in-roles-to-not-download-data-table-visualization-csv/319711/2 "2022-11-24T10:02:40Z")

</div>

I don't think this is currently supported. Feel free to open a feature request at [Issues · elastic/kibana · GitHub](https://github.com/elastic/kibana/issues)

---

<div class="post-metadata">

**Author:** ![Sandeep\_Raju](https://avatars.discourse-cdn.com/v4/letter/s/8797f3/32.png) [@Sandeep\_Raju](https://discuss.elastic.co/u/Sandeep_Raju)\
**Post date:** [November 29, 2022, 5:03am UTC](https://discuss.elastic.co/t/restrict-permissions-in-roles-to-not-download-data-table-visualization-csv/319711/3 "2022-11-29T05:03:47Z")

</div>

This is a security issue as user can download CSV even after read only access.

Have raised an issue:

> <https://github.com/elastic/kibana/issues/146388>
>
> \*\*Read-only Role :\*\* Unable to restrict CSV Download for Read-Only Role or any R…ole.
> 
> \*\*Kibana/Elasticsearch Stack version:\*\* 8.5.2
> 
> \*\*Browser and Browser OS versions:\*\* Google Chrome
> 
> \*\*Functional Area (e.g. Endpoint management, timelines, resolver, etc.):\*\* Security
> 
> \*\*Steps to reproduce:\*\*
> 
> 1. Apply Read-Only Role to a User or Equivalent Role. Map the user to that role.
> 2.Apply Appropriate restrictions for user for Dashboard access. Apply Read-only Access to Dashboard.
> 3.Login as that user and check for dashboard.
> 
> \*\*Current behavior:\*\* Read-Only applies to all aspects . Able to see the dashboard. Unable to download PDF & PNG reports. Able to download CSV Reports. Have applied all roles.
> 
> \*\*Expected behavior:\*\* Read-Only applies to all aspects . Able to see the dashboard. Unable to download PDF & PNG & CSV Reports. User should see Dashboard, but not download CSV reports. We can restrict PDF & PNG reports using reporting, but cannot restrict CSV downloads. Want to show dashboard, but restrict CSV download.
> 
> \*\*Screenshots (if relevant):\*\*
> !\[Screenshot 2022-11-28 at 5 17 35 PM\](https://user-images.githubusercontent.com/74658016/204287367-6cc3cbc8-8417-4604-a285-d1b12746aa4b.png)
> 
> 
> 
> \*\*Any additional context (logs, chat logs, magical formulas, etc.):\*\* User can download CSV reports by clicking on "Raw" & "Formatted" Download Buttons or Click on "Inspect" and Select Data and download CSV Reports.Cannot restrict CSV reports in anyway.

---

<div class="post-metadata">

**Author:** ![system](https://us1.discourse-cdn.com/elastic/original/3X/1/a/1ac57faf039f6b580b3f104ef42a2a89e41014de.png) [@system](https://discuss.elastic.co/u/system)\
**Post date:** [December 27, 2022, 5:04am UTC](https://discuss.elastic.co/t/restrict-permissions-in-roles-to-not-download-data-table-visualization-csv/319711/4 "2022-12-27T05:04:23Z")

</div>

This topic was automatically closed 28 days after the last reply. New replies are no longer allowed.