topic Re: RLS and USERELATIONSHIP problem in Service

RLS and USERELATIONSHIP problem

ju97 — Tue, 14 Jan 2025 08:54:19 GMT

A long standing report has recently had a large majority of visuals show the error when RLS controlled users access:

"The UseRelationship() and CrossFilter() functions may not be used when querying ‘TableA’ because it is constrained by row-level security defined on ‘TableA’ or related tables"

I'm aware of this error and why it occurs, but the report has been working fine, hasn't had any major changes recently, and this issue has only appeared over the weekend.

Can you please confirm if you are aware of that issue and if we can expect some help from you?

Re: RLS and USERELATIONSHIP problem

Idrissshatila — Tue, 14 Jan 2025 11:16:19 GMT

Hello ju97 ,

i didn't see such issue here so far, but you can open an issue that will be investigated by microsoft support and they will assist you if this is a bug https://community.fabric.microsoft.com/t5/Issues/idb-p/Issues/tab/most-recent

Re: RLS and USERELATIONSHIP problem

dhoskins — Thu, 16 Jan 2025 13:14:05 GMT

Same issue for me, no changes made to the report but since the weekend it displays this error across visuals in our report on the service and embedded in our SaaS platform.

When testing RLS roles in desktop, no errors are displayed

Re: RLS and USERELATIONSHIP problem

ElsDEs — Thu, 16 Jan 2025 13:33:38 GMT

I added a bug https://community.fabric.microsoft.com/t5/Service/Sudden-RLS-and-USERELATIONSHIP-problem/m-p/4367400#M261685

hope this helps ...

Re: RLS and USERELATIONSHIP problem

Madsdreyer — Thu, 16 Jan 2025 13:37:07 GMT

We have this issue as well.

Re: RLS and USERELATIONSHIP problem

mostvp123 — Thu, 16 Jan 2025 14:01:24 GMT

Same issue. Is affecting crucial report.

Re: RLS and USERELATIONSHIP problem

Col_Mar — Thu, 16 Jan 2025 14:05:43 GMT

We have the same issue. Seems to have appeared all of a sudden on a report which wasn't an issue before.

Re: RLS and USERELATIONSHIP problem

robertnorman — Thu, 16 Jan 2025 14:14:40 GMT

According to user, 11 pm Swedish CET+1, everything worked fine. Now we have the same problem. Alot of things bugged out. How do we elevate this? Is reporting to MS support even gonna help to prioritize, and where is the best place to report; is it here: https://app.powerbi.com/admin-portal/supportCenter?experience=power-bi

Re: RLS and USERELATIONSHIP problem

AndreiP90 — Thu, 16 Jan 2025 14:34:42 GMT

I have the same issue as well, but there is the following issue, on the description of the function it specifies that it shouldn't work with RLS. It is so confusing.

You have a function that works for years and now you patch it up? Just leave it as it is and create a new one for the intended purpose.

Re: RLS and USERELATIONSHIP problem

robertnorman — Thu, 16 Jan 2025 14:53:25 GMT

This is indeed a bug. If you are a super user why dont you help reporting it. Your link leads to a "New Idea"-request. Sure will try that as well, (but we all know that wont help - quickly).

Re: RLS and USERELATIONSHIP problem

robertnorman — Thu, 16 Jan 2025 14:56:59 GMT

Any more suggestion?

Re: RLS and USERELATIONSHIP problem

Madsdreyer — Thu, 16 Jan 2025 15:03:26 GMT

Can you please link the Remarks?

Re: RLS and USERELATIONSHIP problem

Bbooogie — Thu, 16 Jan 2025 15:19:51 GMT

Like many others. We got the same problem in some of our reports.

Re: RLS and USERELATIONSHIP problem

Madsdreyer — Thu, 16 Jan 2025 15:25:47 GMT

I have been writing with MS support and the reply is:
"USERELATIONSHIP cannot be used when row level security is defined for the table in which the measure is included."

"so please try to avoid those functions"
Also see this https://learn.microsoft.com/en-us/dax/userelationship-function-dax#remarks

So it is not a bug ...

I don't know that to do....

Re: RLS and USERELATIONSHIP problem

stephennin — Thu, 16 Jan 2025 15:33:19 GMT

I think if something has been working a certain way for YEARS and then suddenly doesn't it's a bug, but yeah, we are in the same boat, not sure what to do.

Re: RLS and USERELATIONSHIP problem

Col_Mar — Thu, 16 Jan 2025 15:38:14 GMT

Our model does not have RLS directly defined on the table in which the measure is included (we have a seperate measures table anyway) but its like the security filter is now not working as it was?
We also cannot replicate the issue in Desktop by impersonating the RLS user so it feels like if this was intended behavoir it would also give the same error?

Re: RLS and USERELATIONSHIP problem

mostvp123 — Thu, 16 Jan 2025 16:10:37 GMT

To memory - the purpose of this error is to prevent exposing data to users which they should not see, if there is an active relationship between a dimensional table where RLS is applied, and fact tables in the model. The active relationship propagates RLS from the dimensional table to the fact table. If there was a second, inactive relationship, between the dim table and fact table, trying to enable by using USERELATIONSHIP would cause the error.

However, if there was no active relationship between the two tables (for example, two inactive relationships), USERELATIONSHIP would still work fine. I'm guessing because the lack of an active relationship means RLS is no longer propagating any filters to the fact tables. That is how my model is structured. It seems such a setup is no longer working since this bug started, and in my view, there should be no reason for that. It is almost as if any usage of USERELATIONSHIP between a dimensional table with RLS and fact table is now banned. We need this changed reverted as soon as possible, it also severely limits the usefulness of this formula.

Re: RLS and USERELATIONSHIP problem

mostvp123 — Thu, 16 Jan 2025 16:14:46 GMT

Reposting my reply to another comment on this thread for visibility:

To memory - the purpose of this error is to prevent exposing data to users which they should not see, if there is an active relationship between a dimensional table where RLS is applied, and fact tables in the model. The active relationship propagates RLS from the dimensional table to the fact table. If there was a second, inactive relationship, between the dim table and fact table, trying to enable by using USERELATIONSHIP would cause the error.

However, if there was no active relationship between the two tables (for example, two inactive relationships), USERELATIONSHIP would still work fine. I'm guessing because the lack of an active relationship means RLS is no longer propagating any filters to the fact tables. That is how my model is structured. It seems such a setup is no longer working since this bug started, and in my view, there should be no reason for that. It is almost as if any usage of USERELATIONSHIP between a dimensional table with RLS and fact table is now banned. We need this changed reverted as soon as possible, it also severely limits the usefulness of this formula.

Re: RLS and USERELATIONSHIP problem

EdouardLC — Thu, 16 Jan 2025 21:34:11 GMT

Same issue for my customers..

Re: RLS and USERELATIONSHIP problem

renatochagas03 — Thu, 16 Jan 2025 22:09:13 GMT

It's happening here as well. Yesterday was fine and today broken. I have 40+ dashboards plugged in the same semantic model where all my parent metrics use USERELATIONSHIP with RLS (access control table [BOTH DIRECTION] -> dimension tables [SINGLE DIRECTION] -> [SINGLE DIRECTION] fact tables). My entire audience is now complaining they cannot access the dashboards. We are escalating to Microsoft.