Forum Discussion

kajetanbocek's avatar
kajetanbocek
Regular Visitor
11 months ago
Solved

Object level security for contributors - are separate data sets the solution?

Hi, at my company we have the following situation: We are in the process of adding data from a second module of D365 to PBI. The way this is to be done is through a Fabric Link and from the...
Need Help
  • v-achippa's avatar
    v-achippa
    11 months ago

    Hi kajetanbocek,

     

    Yes this setup will work:

    • The important detail is that group C must not have Contributor/Member/Admin access to the workspace that contains the dataset i.e Workspace A, otherwise RLS/OLS will be bypassed.
    • Keep the dataset in Workspace A and implement RLS and OLS in that model, grant group C Build permission on that dataset and put reports in Workspace B where group C are Contributors.

    This way they can build reports while still being subject to the RLS/OLS defined in the model.

     

    Thanks and regards,

    Anjan Kumar Chippa

kajetanbocek's avatar
kajetanbocek
Regular Visitor
11 months ago

Hi Audrey,

Thanks a lot for your reply and the suggestions!

I have a follow up question:

 

Would distributing reports through an app and creating audiences limit contributors access to the semantic data model?

 

It seems to me like sharing through apps impacts which reports are visible but not which parts of the data model a contributor can see. Please correct me if I misunderstand.

Or maybe giving super users contributor access to a workspace is an outdated way of granting them the necessary access? 

Many thanks in advance.

audreygerred's avatar
audreygerred
Icon for Super User rankSuper User
11 months ago

Contributors have access to everything - OLS and RLS do not apply to them. Going back to least privilege access - if people are not actively developing semantic models I do not give them access to a workspace. People that you want to view your reports should access them through the app. If you are in a self-service situation where you want people to utilize the model to do their own reporting they should not have access in your wrkspace, but they should have build access on the semantic model.