Forum Discussion

Kevdie11's avatar
Kevdie11
Frequent Visitor
4 years ago

Row Level Security

I created Roles within Power Bi Desktop. When I test them within Desktop they work as expected.

 

After I publish the report, I set up security as one should. When I "Test as Role", the RLS works as expected, but when I test as a user (the person is allocated to the role I mentioned above), then they can see all data. This seemed like it should work as simply as that, why is it not working? Also, when I ask the user to test, he advised that he can still see all data when he logs in.

 

I also added them as a "Viewer" to the Workspace.

 

Thank You

General Comment
Need Help

5 Replies

  • edhans's avatar
    edhans
    Community Champion
    4 years ago

    I would have to see more to understand what exactly isn't working, but I would remove the user from the workspace entirely and only add them as a viewer to the App for the workspace. 

    • Kevdie11's avatar
      Kevdie11
      Frequent Visitor
      4 years ago

      So here is my data model.

       

      All we basically did was create a role for every Salesperson, and then we want to link every Salesperson's Email address to the respective roles on Power Bi Online. I.e. They should only be able to see Sales data pertaining to them.

      Let me give you an example:

       

      I create a role for "Online" Salesperson

       

       

      Here you can see the user's access to the workspace

      Here you will see I have added Richard to the role

      Here I am testing the role (Now viewing as: Online) You'll notice that I can only see data for Online.

       

       

      But, when I change it to view as "Richard Stevens" (who is allocated to the Online Role ONLY), then I can see all data.

       

      Thanks in advance

       

       

      • edhans's avatar
        edhans
        Community Champion
        4 years ago

        Get rid of both the Sales Person master and Customer Grouping master. Merge those into Customer master. Sales Person and Groupings are just additional attributes.

        I am not sure what Customer Created is, but don't relate that to Sales Fact table. Never relate fact tables together.

        Finally, get rid of the Bi-Di relationship between Customer Master and Sales Fact Table. Should be 1 to many.

         

        You have model ambiguity. For example, Customer Master directly filters Customer Created. But It can also filter Sales Fact Table which in turn filters Customer Created. so there are two ways for data to get filtered and you cannot control what path the model uses. 

        Then try RLS. 

  • v-yanjiang-msft's avatar
    v-yanjiang-msft
    Community Support
    4 years ago

    Hi Kevdie11 ,

    1. When select View as, if you want to enter the user name to test, you should checked the role name at the same time.

    If you only checked the Other user, you will see all the data.

    2. If the user can see all the data in Service, check if you have a group in the workspace member/contributor/admin, and the RLS user is in the group. In this way, RLS will be invalid and he will see all the data.

     

    Best Regards,
    Community Support Team _ kalyj

    If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

     

  • v-yanjiang-msft's avatar
    v-yanjiang-msft
    Community Support
    4 years ago

    Hi Kevdie11 ,

    Is your problem solved?? If so, Would you mind accept the helpful replies as solutions? Then we are able to close the thread. More people who have the same requirement will find the solution quickly and benefit here. Thank you.

    Best Regards,
    Community Support Team _ kalyj