Amerivike's avatar
Amerivike
Advocate II
4 years ago
Status:
Done

December Update Issue - Multiple Roles in Row Level Security causing errors for user

We have had our row level security configured like this for a long time. After the December update, suddenly users that are part of two different security roles are getting an error on all visuals st...
Data Modeling
eric_collins's avatar
eric_collins
New Member
4 years ago

For anyone still struggling with this, I put it a ticket last week. I was told over the phone that this would be patched in a future update, but that they couldn't give timelines. As some other users have pointed out, this seems to be because they changed the way many-to-many relationships work, and was at least known about prior to the update, because they changed the error message. We're fortunate our staff can be easily split by security level, but so many other companies don't have that luxury. Ultimately, a change at this level should have AT LEAST been made known prior to release. I've included the support email for anyone that needs it. 

 

 

Hello Eric

 

Thanks for your response!

 

Regarding your case, this seems to be related to a Known Issue.

 

Here’s what our Product Group mentioned regarding this :

 

“Please see the below changes to resolve this issue:

 

Nature of the problem: Power BI customers might experience issues while loading visuals and running DAX queries if below conditions are met:

  1. User who belongs to multiple RLS roles runs DAX query.
  2. At least one of the RLS filters is flowing through “limited” relationship.

 

See more details about limited relationships:

Model relationships in Power BI Desktop - Power BI | Microsoft Docs

We replaced analysis services behavior for scenario #3 to raise a following runtime error:

The user belongs to multiple roles 'CustomerPerm, TimePerm' that have security filters, which isn't supported when one of the roles has filters affecting table 'Sales' with SecurityFilteringBehavior=Both relationships.

(“SecurityFilteringBehavior=Both” – this part is confusing, sorry about that. The error will be improved.)

 

Product Group is working on fully enabling this scenario in secure fashion for PowerBI products and it will be deployed in the upcoming releases of PowerBI.

 

 

Workarounds:

Customer needs to fix their problematic model to remove risk of unintentional information disclosure. To improve your model and avoid this error, please adopt one of the following options. It is introduced only to avoid potential data leak and improve the RLS model.

  1. Do not put any user into multiple roles (feasible for small/manageable number of roles):
    1. For user that belongs to both RLS_1 and RLS_2 create another RLS role e.g., RLS_12 which combines DAX filters as follows RLS_12 => RLS_1 union RLS_2.
    2. Remove user from RLS_1 and RLS_2, add user to RLS_12.

 

  1. Keep PowerBI RLS on single datasource island.

If it's necessary for a single user to belong to multiple security roles, make sure all RLS filters associated with the roles are defined on tables from a single data source.

 

  1. [Emergency option for PowerBI Premium only] Contact Microsoft Product Group to disable DAXStrictMultiRolesQueryPlanValidation and accept the risk associated with that decision.”

Completed Ideas