Forum Discussion

ChrisKr's avatar
ChrisKr
New Member
3 months ago
Solved

Service - RLS

Hello, I have the following situation: I have a Power BI report (desktop) containing a table with transaction data that should only be visible to specific users. This table includes, for example, th...
Need Help
Tips and Tricks
  • Parchitect's avatar
    Parchitect
    3 months ago
    Hi ChrisKr,

     

    Report access and RLS role membership are two different things, but I would also check the workspace role level.

     

    For Dynamic RLS, the users/security group normally need both:
    1. Access to open the report/app/workspace
    2. Membership in the RLS role under Semantic model → Security

     

    Adding the AD/Entra group as Viewer to the workspace only gives access to open the content. It does not by itself define the RLS filter. The same group, or another group containing the same users, should also be added to the RLS role under the semantic model security page.

     

    The other important point: RLS only applies to Viewers. If the users are getting access through any group that gives them Member, Contributor, or Admin permissions in the workspace, they can bypass RLS and may see all rows.

     

    So I would check these three things:
    - Is the NV group added to the RLS role under Semantic model → Security?
    - Is the NV group only Viewer/app audience access, not Member/Contributor/Admin?
    - Are affected users members of another AD/Entra group that gives higher workspace access?

     

    Also, if you have multiple RLS roles, check that users are not landing in more than one role. RLS filters are additive when a user maps to multiple roles, so that can also return more data than expected.

     

    For your setup with 700 users, using an Entra security group is the right approach. Just keep access and RLS separate:
    - Group for report/app access
    - Same or separate group assigned to the RLS role
    - Users should remain Viewer-level consumers, not workspace Contributors/Members/Admins
     

    🔍Parchitect
    Solutions Architect · Microsoft Fabric Specialist

    💡Helpful? Kudos are appreciated.
    ✔️Solved? Mark as Solution so others can find it faster.

GilbertQ's avatar
GilbertQ
Icon for Super User rankSuper User
3 months ago

Hi ChrisKr 

 

One other thing I would add is that you certainly don't need to give the users a workspace view a role in order for row level security to work successfully. You should be able to just add them to an app, make sure that they have got read permissions on the semantic model and are in the appropriate row level security role and it will work.