Forum Discussion
Directlake Row Level Security
I'm running into an issue applying RLS to a DirectLake model, where I receive the error "The user belongs to multiple roles '' that have security filters, which isn't supported when one of the roles has filters affecting the table fact_end_customer_sales with SecurityFilteringBehavior=Both relationships." The security setup is being carried over from an import model, where it works without issue.
There are two tables included in the RLS configuration, with a many-to-many relationship between them.
- dim_sales_assignments (filters fact_end_customer_sales)
- fact_end_customer_sales
One of the security roles applied to the model filters on the dim_sales_assignments table; the other filters fact_end_customer_sales.
I found a few reports of similar issues with PBI Desktop from 2022, which seemed to indicate this was a bug that was fixed.
- https://community.fabric.microsoft.com/t5/Desktop/RLS-roles-combination-amp-Security-Filtering-Behavior-Both/td-p/1155600
- https://community.fabric.microsoft.com/t5/Service/Dashboard-with-multiple-RLS-roles-work-in-My-Workspace-but-fails/m-p/2264783#U2264783
- https://stackoverflow.com/questions/70567259/row-level-security-rls-in-power-bi-with-multiple-roles-does-not-work-anymore
Does anyone know if this is a bug with DirectLake models or is this the intended behavior?
Edit (2025-12-11):
I've tried creating a bridge table so the relationship doesn't directly filter the fact table and that did not help. I've also tried removing all of the RLS rules on the fact table and have moved them to the dimensions. That also did not help. The N:N RLS rule will only apply if it is the only one defined in the model; otherwise, I get the error.
Thank you.
steveplatz2 Current Workarounds
To avoid the error:Combine all RLS logic into a single role, or
Refactor the model to avoid N:N security filtering when multiple roles must be allowed, or
Use Import or DirectQuery mode, which do support merging RLS roles.
please mark this solution. Thanks
4 Replies
This is actually expected behavior with Direct Lake right now.
Even though the same RLS setup works in an Import model, Direct Lake handles security differently. At the moment, it cannot combine multiple RLS roles when one of them filters through a many-to-many relationship or uses SecurityFilteringBehavior = Both.
That’s why you’re seeing the error message about the user belonging to multiple roles.So this isn’t a bug in your model—it's simply a Direct Lake limitation today. Hopefully Microsoft enables full multi-role RLS support in the future.
Thank you for the reply. I assume there is no workaround for this limitation today? Any chance you know if correcting this is something that's on their roadmap?
steveplatz2 Current Workarounds
To avoid the error:Combine all RLS logic into a single role, or
Refactor the model to avoid N:N security filtering when multiple roles must be allowed, or
Use Import or DirectQuery mode, which do support merging RLS roles.
please mark this solution. Thanks
steveplatz2 Can you mark this as accepted solution and close the thread please.
