Forum Discussion
Service - RLS
Hello, I have the following situation:
I have a Power BI report (desktop) containing a table with transaction data that should only be visible to specific users. This table includes, for example, the employee ID number as a unique identifier. Another table contains information about which users are authorized to view the transaction data associated with each employee ID number, as well as their corresponding email addresses. The employee ID numbers in both tables are linked in the data model.
I then created a role that retrieves the email address as follows: [Mail] = USERPRINCIPALNAME()
I subsequently published the report in the Power BI service and added the users to the Semantic Model under Security – but with the Active Directory group "NV" (containing all email addresses from the table).
If I add users (email addresses) with "View" permissions to the workspace to enable its use, it works (the user only sees what they're supposed to see) if I add the users individually, but unfortunately not if I use the AD group "NV" (in this case, the user strangely sees everything). I don't want to add each user to the workspace individually, as there are over 700 users.
Am I doing something wrong?
- Hi ChrisKr,Report access and RLS role membership are two different things, but I would also check the workspace role level.For Dynamic RLS, the users/security group normally need both:1. Access to open the report/app/workspace2. Membership in the RLS role under Semantic model → SecurityAdding the AD/Entra group as Viewer to the workspace only gives access to open the content. It does not by itself define the RLS filter. The same group, or another group containing the same users, should also be added to the RLS role under the semantic model security page.The other important point: RLS only applies to Viewers. If the users are getting access through any group that gives them Member, Contributor, or Admin permissions in the workspace, they can bypass RLS and may see all rows.So I would check these three things:- Is the NV group added to the RLS role under Semantic model → Security?- Is the NV group only Viewer/app audience access, not Member/Contributor/Admin?- Are affected users members of another AD/Entra group that gives higher workspace access?Also, if you have multiple RLS roles, check that users are not landing in more than one role. RLS filters are additive when a user maps to multiple roles, so that can also return more data than expected.For your setup with 700 users, using an Entra security group is the right approach. Just keep access and RLS separate:- Group for report/app access- Same or separate group assigned to the RLS role- Users should remain Viewer-level consumers, not workspace Contributors/Members/Admins
🔍Parchitect
Solutions Architect · Microsoft Fabric Specialist💡Helpful? Kudos are appreciated.
✔️Solved? Mark as Solution so others can find it faster.
4 Replies
Hi ChrisKr
One other thing I would add is that you certainly don't need to give the users a workspace view a role in order for row level security to work successfully. You should be able to just add them to an app, make sure that they have got read permissions on the semantic model and are in the appropriate row level security role and it will work.
Hi ChrisKr,
Adding the AD group (NV) as Viewer only grants users permission to open the report and it does not apply row-level security.
RLS is enforced only when the user or group is added to a role under - Semantic Model → Security (RLS)
Viewer role controls who can access the report, while RLS role determine what data they can see — both are required.💡 Helpful? Give a Kudos 👍 — keep the community growing
✅ Solved your issue? Mark as Solution ✔️ — help others find it faster
Best regards,
Rupasree Achari | BI & Fabric Analytics Engineer- Hi ChrisKr,Report access and RLS role membership are two different things, but I would also check the workspace role level.For Dynamic RLS, the users/security group normally need both:1. Access to open the report/app/workspace2. Membership in the RLS role under Semantic model → SecurityAdding the AD/Entra group as Viewer to the workspace only gives access to open the content. It does not by itself define the RLS filter. The same group, or another group containing the same users, should also be added to the RLS role under the semantic model security page.The other important point: RLS only applies to Viewers. If the users are getting access through any group that gives them Member, Contributor, or Admin permissions in the workspace, they can bypass RLS and may see all rows.So I would check these three things:- Is the NV group added to the RLS role under Semantic model → Security?- Is the NV group only Viewer/app audience access, not Member/Contributor/Admin?- Are affected users members of another AD/Entra group that gives higher workspace access?Also, if you have multiple RLS roles, check that users are not landing in more than one role. RLS filters are additive when a user maps to multiple roles, so that can also return more data than expected.For your setup with 700 users, using an Entra security group is the right approach. Just keep access and RLS separate:- Group for report/app access- Same or separate group assigned to the RLS role- Users should remain Viewer-level consumers, not workspace Contributors/Members/Admins
🔍Parchitect
Solutions Architect · Microsoft Fabric Specialist💡Helpful? Kudos are appreciated.
✔️Solved? Mark as Solution so others can find it faster. Hello ChrisKr
Simple thing, you can add your NV AD groups to security role and add to your respective workspace as "Viewer" role. If you grant any other role apart of Viewer they would able to see all the data. RLS will work only for Viewer role.
Hope this helps you.
Thank you!!
Did I answer your question? Mark my post as a solution!
Proud to be a Super User!
