Dynamic RLS Only Works Properly in Desktop

[astano05]

I have a salesman table (name, ID, email) connected to a customer assignment table (customer ID, name, assigned salesperson) connected to a customer table (customer ID, region, etc.). I set up dynamic RLS as Email=UserPrincipalName() on the salesman table.

When I test the role in desktop (Security --> View As --> Other User = sales rep email address; Sales Rep role checked) it works properly, but when I have the same user I tested with test in PBI Service on his end, he sees additional values outside his territory. What could be causing the disconnect between service and desktop?

[v-easonf-msft]

Hi, @astano05 

Could you please tell me whether your problem has been solved?For now, there is no content of description in the thread. If you still need help, please share more details to us.

Best Regards,
Community Support Team _ Eason

[v-easonf-msft · Accepted solution]

Hi,  @astano05 

For RLS to work, a user needs to have read only permission in the workspace.Workspace members assigned Admin, Member, or Contributor have edit permission for the dataset.They can see everything by default. So RLS doesn’t apply to them. 

If user can sees additional values outside his territory , please make sure the user can only view the report and have no permission to edit the report.

https://docs.microsoft.com/en-us/power-bi/admin/service-admin-rls#using-rls-with-workspaces-in-power... 

Best Regards,
Community Support Team _ Eason

[Gabriel_Walkman]

Did you assign the role to the person or group holding the person in dataset settings?

Is the sales rep invited to your tenant? If so, the UserPrincipalName() might return a funky format:

So basically, I've determined there are 3 different e-mail formats that get return: 1) regular, 2) live.com# prefix, and 3) abc_workmail.com#EXT#(at)onmail.mail.com