Forum Discussion

ChrisKr's avatar
ChrisKr
New Member
4 months ago
Solved

Service - RLS

Hello, I have the following situation: I have a Power BI report (desktop) containing a table with transaction data that should only be visible to specific users. This table includes, for example, th...
Need Help
Tips and Tricks
  • Parchitect's avatar
    Parchitect
    4 months ago
    Hi ChrisKr,

     

    Report access and RLS role membership are two different things, but I would also check the workspace role level.

     

    For Dynamic RLS, the users/security group normally need both:
    1. Access to open the report/app/workspace
    2. Membership in the RLS role under Semantic model → Security

     

    Adding the AD/Entra group as Viewer to the workspace only gives access to open the content. It does not by itself define the RLS filter. The same group, or another group containing the same users, should also be added to the RLS role under the semantic model security page.

     

    The other important point: RLS only applies to Viewers. If the users are getting access through any group that gives them Member, Contributor, or Admin permissions in the workspace, they can bypass RLS and may see all rows.

     

    So I would check these three things:
    - Is the NV group added to the RLS role under Semantic model → Security?
    - Is the NV group only Viewer/app audience access, not Member/Contributor/Admin?
    - Are affected users members of another AD/Entra group that gives higher workspace access?

     

    Also, if you have multiple RLS roles, check that users are not landing in more than one role. RLS filters are additive when a user maps to multiple roles, so that can also return more data than expected.

     

    For your setup with 700 users, using an Entra security group is the right approach. Just keep access and RLS separate:
    - Group for report/app access
    - Same or separate group assigned to the RLS role
    - Users should remain Viewer-level consumers, not workspace Contributors/Members/Admins
     

    🔍Parchitect
    Solutions Architect · Microsoft Fabric Specialist

    💡Helpful? Kudos are appreciated.
    ✔️Solved? Mark as Solution so others can find it faster.

suparnababu8's avatar
suparnababu8
Icon for Super User rankSuper User
4 months ago

Hello ChrisKr 

 

Simple thing, you can add your NV AD groups to security role and add to your respective workspace as "Viewer" role. If you grant any other role apart of Viewer they would able to see all the data. RLS will work only for Viewer role.

 

Hope this helps you.

 

Thank you!!

 

Did I answer your question? Mark my post as a solution!

Proud to be a Super User!