Forum Discussion
Helper IObject Level Security Security Roles Not Working
Hi rebeccaETE
If people can see all data without being assigned any security role, they should have edit permission in Power BI workspace. There are two kinds of app workspace in Power BI Service.
New workspace: admins, members and contributors have edit permission.
You may refer to this blog about roles in new workspace.
Classic workspace: only has two roles admin and member. Admin can assign edit or view permission to member in this classic workspace.
For reference:Create a classic workspace based on a Microsoft 365 group
Could you tell me if your problem has been solved? If it is, kindly Accept it as the solution. More people will benefit from it. Or you are still confused about it, please provide me with more details about your problem.
Best Regards,
Rico ZhouIf this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Helper II found this on a blog post on the matter (https://5minutebi.com/2021/07/05/power-bi-object-level-security/
Can that really be? So the Contributor and Member roles in a given workspace automatically supersedes the OLS roles? That seems weird.
Hi rebeccaETE
The end user needs to only have read permission to the report. I test OLS, I find it is similar like RLS in Power BI. If your end user have edit permission to the report, the OLS/RLS will not work. They could see all things in your report.
Best Regards,
Rico Zhou
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
- rebeccaETE
Hi Anonymous,
Yes but having read access to the report doesn't ensure that they can see the report, if they are not in OLS roles, I found.
My colleague had read access to the data model and the app to which I published the report. But if hadn't put him in any of the OLS roles, he couldn't see the report at all. He had build access to the model also, and that did not matter.
I also tried testing his build access, when in the role "cannot see table". Sure enough, if he connected to the model, he could see all the tables EXCEPT the one locked by OLS.
So I found that build access does not supersede OLS. However, workspace membership does. When I added him to the workspace to which the data model is published, it didn't matter what OLS role I gave him, he could see everything.
Are these the same result you got when testing it?
Hi rebeccaETE
Edit permission does not mean build permission to the dataset. It means edit permission the workspace memvers like admin, member or contributor assigned in their workspace. You need to add the users into the role in Security in Power BI Service. Or the users don't have edit permission will see nothing due to OLS.
For reference: Using RLS with workspaces in Power BI
Even if Viewers are given Build permissions to the dataset, RLS/OLS still applies. Workspace members assigned Admin, Member, or Contributor have edit permission for the dataset and, therefore, RLS doesn’t apply to them. If you want RLS to apply to people in a workspace, you can only assign them the Viewer role.
Best Regards,
Rico ZhouIf this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
- rebeccaETE
Hi Anonymous
Yes, that is exactly what I found. Just didn't know that workspace membership (with that I mean members, admins and contributors) was called "edit permission". Still new to all this terminology 😅
What I was afraid of originally was that people not assigned any security role could view the data as default, since I heard many say that the default permission is equivalent to read in Tabular Editor. But I found that that was not the case, so I'm more confident with using OLS now.
Thanks for taking your time with this