Forum Discussion
Implementing RLS in Dynamic Subscriptions
Hi all,
Looking for some guidance here regarding the new dynamic subscriptions. Is there a way that I can implement my existing RLS in the model to my subscriptions? I have a contact list to power the subscriptions which contains an email address. subject and an attachment format (PDF or PowerPoint). As I understand it, the user identification that usually passes for RLS in service does not pass for subscriptions, so how can I enforce my same RLS principals to subscriptions?
Thanks!
Hi THowkins96 ,
Please ensure all the prerequisites are being metAdditionally, re check all the steps that are mentioned in the document and check.
I hope this information helps. Please do let us know if you have any further queries.
Thank you
11 Replies
Hi THowkins96
I was under the impression that when using dynamic subscriptions, the row level security will still kick in because you're specifying the user of whom the email is going to be sent to. I would highly recommend testing this out to see if their functionality does actually work.
Hey GilbertQ
My understanding was the same, I expected the existing RLS rules in the model to apply automatically within dynamic subscriptions. To test this, I used a separate test account and validated against a rule in my model where the username in my RLS table must match UserPrincipalName(). In the Power BI Service model, I intentionally didn’t assign that security role to any security group, specifically to confirm that the subscription output would return blank if RLS wasn’t being honoured.
Based on the results, it seems like I may need to find a way to enforce impersonation so that the subscription runs as the intended user and therefore applies the correct RLS filtering.
For context, our organisation’s RLS structure is built around a core RLS table containing user emails and the “nodes” they’re associated with. This table has a many-to-many relationship with an RLS Outlet table that maps nodes to their corresponding outlets. From there, the RLS Outlet table links (many-to-one) to the main Outlet table, which ultimately filters what each user is allowed to see. For example: if User X has access to Node A, and Node A contains Outlets 1, 2 and 3, then User X should only see those outlets.
Do you have any guidance for how I could achieve this end result?
Thanks!Hi. I wouldn't assume it works because it doesn't specify anything about rls at microsoft docs: https://learn.microsoft.com/en-us/power-bi/collaborate-share/power-bi-dynamic-report-subscriptions
I think depending on the details of your RLS implementation, you could use the dynamic rls table for sending the subscription. The RLS DAX filters may not be active, but if the table you filter by username will filter downstream tables in the normal way. It's like imaging you have loaded a table with the emails you need for the subscription without even considering rls, just for configuring the subscription.
I hope that helps,
Hi THowkins96
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.
Thank you.Hi THowkins96
May I check if this issue has been resolved? If not, Please feel free to contact us if you have any further questions.
Thank you
