Forum Discussion
Solved
Service - RLS
Hello, I have the following situation: I have a Power BI report (desktop) containing a table with transaction data that should only be visible to specific users. This table includes, for example, th...
- Hi ChrisKr,Report access and RLS role membership are two different things, but I would also check the workspace role level.For Dynamic RLS, the users/security group normally need both:1. Access to open the report/app/workspace2. Membership in the RLS role under Semantic model → SecurityAdding the AD/Entra group as Viewer to the workspace only gives access to open the content. It does not by itself define the RLS filter. The same group, or another group containing the same users, should also be added to the RLS role under the semantic model security page.The other important point: RLS only applies to Viewers. If the users are getting access through any group that gives them Member, Contributor, or Admin permissions in the workspace, they can bypass RLS and may see all rows.So I would check these three things:- Is the NV group added to the RLS role under Semantic model → Security?- Is the NV group only Viewer/app audience access, not Member/Contributor/Admin?- Are affected users members of another AD/Entra group that gives higher workspace access?Also, if you have multiple RLS roles, check that users are not landing in more than one role. RLS filters are additive when a user maps to multiple roles, so that can also return more data than expected.For your setup with 700 users, using an Entra security group is the right approach. Just keep access and RLS separate:- Group for report/app access- Same or separate group assigned to the RLS role- Users should remain Viewer-level consumers, not workspace Contributors/Members/Admins
🔍Parchitect
Solutions Architect · Microsoft Fabric Specialist💡Helpful? Kudos are appreciated.
✔️Solved? Mark as Solution so others can find it faster.
Parchitect
Solution Sage
Solution SageHi ChrisKr,
Report access and RLS role membership are two different things, but I would also check the workspace role level.
For Dynamic RLS, the users/security group normally need both:
1. Access to open the report/app/workspace
2. Membership in the RLS role under Semantic model → Security
Adding the AD/Entra group as Viewer to the workspace only gives access to open the content. It does not by itself define the RLS filter. The same group, or another group containing the same users, should also be added to the RLS role under the semantic model security page.
The other important point: RLS only applies to Viewers. If the users are getting access through any group that gives them Member, Contributor, or Admin permissions in the workspace, they can bypass RLS and may see all rows.
So I would check these three things:
- Is the NV group added to the RLS role under Semantic model → Security?
- Is the NV group only Viewer/app audience access, not Member/Contributor/Admin?
- Are affected users members of another AD/Entra group that gives higher workspace access?
Also, if you have multiple RLS roles, check that users are not landing in more than one role. RLS filters are additive when a user maps to multiple roles, so that can also return more data than expected.
For your setup with 700 users, using an Entra security group is the right approach. Just keep access and RLS separate:
- Group for report/app access
- Same or separate group assigned to the RLS role
- Users should remain Viewer-level consumers, not workspace Contributors/Members/Admins
🔍Parchitect
Solutions Architect · Microsoft Fabric Specialist💡Helpful? Kudos are appreciated.
✔️Solved? Mark as Solution so others can find it faster.