Forum Discussion
Advocate IOnelake Catalog Semantic Model - RLS Issue
Outline:
My report is based on the OneLake Catalog semantic model. I published my report in an app and created an audience group specific to that report. My report includes enrollment information for all Rice University schools, and the ask is to apply RLS at the school level, so each school can view only its own enrollment. I have a Dim_School in my upstream, with a distinct of all the schools, and there are fact tables: one for course details and the other for program details, joined to this Dim_School.
As a next step for applying RLS, steps followed:
1. I created a "User School Mapping" table, and assigned 2 users and their corresponding schools for testing
User School Mapping =
DATATABLE (
"User Email", STRING,
"School", STRING,
{ {"****@rice.edu","Engineering and Computing" },
{"*****@rice.edu","Engineering and Computing" }
}
)
2. Then created a School_Access_Role with DAX rule, so only the user having restriction will be restricted to the corresponding school, the rest should be able to view all the schools. This way I don't have to join the Dim_School and the User School Mapping
VAR CurrentUser = LOWER(TRIM(USERPRINCIPALNAME()))
VAR HasRestriction =
CONTAINS(
'User School Mapping',
'User School Mapping'[User Email],
CurrentUser
)
RETURN
IF (
NOT(HasRestriction),
TRUE(),
CONTAINS(
'User School Mapping',
'User School Mapping'[User Email], CurrentUser,
'User School Mapping'[School], Dim_School[SCHOOL]
)
)
3. Identified the Sematic model from the workspace, selected security, and added the users to it, then saved it.
4. Asked the user with RLS applied to test the report, but the user gets a message saying "It's loading, but nothing happens".
What else could I have done here? Experts seeking your guidance, please advise.
Thank you all for the assistance! Issue resolved with the help of Microsoft Support
Recommended actions:
- Create a separate connection instead of SSO in the Gateway and Cloud Connections specific to the semantic model.
- Add recipients/ group and give Read-only permissions to the semantic model (semantic model -> manage permissions -> Allow recipients to build content with the data associated with this semantic model
- Tried this and tested the RLS with the user, it worked perfectly!
8 Replies
- Praful_Potphode
Super User
Hi RajiKarthik
I think you found the issue.another article worth reading is below
Please give kudos or mark it as solution once confirmed.
Regards,
Praful
jubinsoniAdvocate IV
Hi RajiKarthik, a few things worth checking. First, RLS roles only apply to people who have Viewer access in the workspace that holds the semantic model, or access through the app or a direct share, so anyone who is Member, Contributor or Admin there will bypass it and testing with those accounts can be misleading. Second, since the report sits on a shared OneLake catalog model, the roles and the member assignments must be on that source semantic model, not on the report. Third, make sure the mapping table actually filters Dim_School. The role filter should sit on the mapping table or on Dim_School using the signed in user, and the relationship from Dim_School to the fact tables should be single direction and active so the filter flows down to both facts. Use the View as role option in the service with the test user email to see whether the report loads or hangs, and also confirm your DATATABLE rows have the real distinct email for each user since both rows in the post look identical.
AI-assisted drafting: AI was used to help structure and phrase this response. I reviewed and validated the technical content before posting.
RajiKarthikHi jubinsoni, answer to your questions:
- The user is just a viewer; no other role is assigned to that user yet.
- The role is created on Dim_School on the underlying semantic model. I don't have the option to create the role in the report, as it is based on the onelake catalog semantic model.
- The relation from dim to fact is 1 to *(facts)
- Cannot perform "Test as a role", as it's SSO login mode
- Praful_Potphode
Hi RajiKarthik
Try below things and let me know if it works:
- Check the format USERPRINCIPALNAME() in card. Whether it matches with your format(*****@rice.edu).
- Test the user from service using view as option(https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security#validate-the-role-within-the-power-bi-service)
- Check permissions on semantic model,report and App .check if they live in different workspace.
- If the semantic model has any data source credential configured as single sign in, check if all users as access to it.
Please give kudos or mark it as solution once confirmed.
Regards,
Praful
- DreamITLearn
Advocate II
Hi RajiKarthik,
the “loading but nothing happens” behavior is probably not your DAX. It’s more likely how RLS behaves on a composite model sitting on top of a OneLake catalog semantic model.Most likely causes:
- Mixed storage in the rule: Dim_School comes from the upstream model (DirectQuery), while your DATATABLE mapping is a local table. A role filter that crosses these two source groups is a common cause of visuals that hang or never resolve.
- Upstream permissions: In a composite model, viewers also need Read/Build access on the upstream semantic model, and any upstream RLS applies to them too. A missing permission here often shows up as endless loading.
- “Everyone else sees all” needs a role too: Once RLS is enabled, any viewer who isn’t in a role sees nothing. Add all other users to a role with TRUE(), or use two roles. Workspace Admin/Member/Contributor accounts bypass RLS, so don’t use them to validate it.
What I’d do:
- Move the mapping table and the RLS role into the upstream semantic model, next to Dim_School, so the filter stays within a single source group and you may not need a composite model at all.
- Simplify the rule to a single filter on Dim_School, such as Dim_School[SCHOOL] IN CALCULATETABLE(VALUES('User School Mapping'[School]), 'User School Mapping'[User Email] = USERPRINCIPALNAME()), and handle unrestricted users through a separate role.
- Test with “Test as role” in the Service, then with a real restricted user who is not a workspace member.
- RajiKarthik
DreamITLearn, Thanks for confirming that it has nothing to do with DAX. I would like to clarify a few things.
- Mine is not mixed storage, as the table was created in the semantic model, rather than the report. So the report still uses the direct connection from the onelake semantic model
- Test as role option is not feasible. I am unable to test this option because we have SSO enabled for login validation. The Test as role/View as role feature doesn't work for models with single sign-on (SSO) enabled.
- RajiKarthik
Thanks for your response:
- I tried testing it, and it matched the format I have added in the table
- I am not able to test this option as we have SSO enabled for login validation. The Test as role/View as role feature doesn't work for models with single sign-on (SSO) enabled.
- I was checking the settings and exploring the options, and I found this error message
It works differently for Onelake catalog semantic model, I guess. I am checking this article for further info
https://learn.microsoft.com/en-us/fabric/fundamentals/direct-lake-security-integration
- RajiKarthik
Thank you all for the assistance! Issue resolved with the help of Microsoft Support
Recommended actions:
- Create a separate connection instead of SSO in the Gateway and Cloud Connections specific to the semantic model.
- Add recipients/ group and give Read-only permissions to the semantic model (semantic model -> manage permissions -> Allow recipients to build content with the data associated with this semantic model
- Tried this and tested the RLS with the user, it worked perfectly!
