Dynamic Row-Level Security ( Setup for PowerBI.com )

Hi,

I have followed various blogs and advice on here to setup dynamic Row-Level security and on the whole have got it working as required.  I can then test this using the "View As Roles" option which then gets logged in user from the userprincipalname() function and filters the data accordingly.

My main question is what I need to setup in PowerBI.com to get it working properly. The report is published to an App workspace and I am using the published apps to distribute the report, as have been told that is the best way to distribute to lots of people as I can just add an AD group to the app list of people who need access. Due to this I was hoping that I did not have to add the users as a memeber to the main workspace.

But on final testing the app just returns the crosses with no data and the only way I seem to be able to get it working as required is if I add the users into the dataset security tab in the members list for the dynamic role I created.

This seems to add an additional administrative task in that I was hoping would not be required when setting up the dynamic security. Is this really required or am I missing something?

Thanks in advance.