Implement RLS through an Import-Mode Table onto a Published and Connected Semantic Model

[Knegge]

Hi,
i have been trying for a while now, maybe someone can help me.
I have a published Semantic Modell (without RLS) that I connect to. I have an additional table that I am adding as an imported table from DBX. The imported table serves as a RLS Table with emails and Profit Center information. I connect this table to the Business Hierarchy Table of the Semantic model and implemented an RLS Role onto that imported table.
When trying view as the RLS on the importet table works but it does not migrate through to the connected Semantic Model from the Service. 
When I first published I got an Extension error for the login info, although DBX is connected through a gateway and the Semantic model I have access to.
After a while the error disappeard and I could add the Mails to the RLS Role.
When someone with access to the report opened it he could not see any info in the RLS Table (he has no rights there, so as expected) but all connected tables remained unchanged by the RLS and he could see all. 
Can anyone please help.

BR Knegge
Here is a screenshot of the Relationship (connection is 1:1)



I have some other thoughts and bits of info that might be the reasons but I cannot validate and dont know:
When connecting to a Semantic Model it is a "Live" Connection but it can be switched when adding a local table and than it is Direct Query, but is it really? 
Live Connections cannot have a RLS put ontop but Direct Query should be able to?

[MFelix]

Hi @Knegge ,

I'm looking into your relationships and you have a one to one from the RLS to a Business hierarchy is this table a dimension table or a fact table? How does the Business hierarchy relates to the rest of the model?

Also can you share what is the formula that you are using in the RLS and in what field you are applying the DAX for the RLS.

[Knegge]

Hi Miguel,
The Business Hierarchy Table is the shared Dimension Table for some fact tables.
The DAX for the RLS is "

CONTAINSSTRING('Profit Center RLS'[email_array],USERPRINCIPALNAME())" since the Mails are in an array.

In a seperate model that has all tables as import mode from DBX this filtering through the 1:1 RLS to BH works without fail.

For this specific case it is nessecary that I apply the RLS thorugh a new imported table from DBX  to a published Semantic Model that doesnt have RLS on it yet.

[MFelix]

Hi @Knegge ,

Apologies for the late answer, and also apologies for this late explanation but my first focus was the RLS and although you have gave a good print-screen and explanation on the way you picked up the tables I did some "selected reading".

When we have a composite model the tables that are not within the same type or location when the relationship is created they have a weak realationship that is why you have a break icon near your tables on your screenshoot.

Adding to this and much more important is that the RLS is only supported for Import and Direct Query not simultaneos, and when you refer to Live connections to Analysis services, your case then this needs to be handle in the on-premises model.

https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security#considerations-an...

You can also check this video with an explanation on how this limitations work and why

Overall the short answer is that for the RLS to work you need to do it in the semantic model you have and not on the Direct Query one since it's connected to analysis services.

[v-achippa]

Hi @Knegge,

Thank you for reaching out to Microsoft Fabric Community.

Thank you @MFelix for the prompt response.

Thank you for the response and additional details.

The DAX expression itself looks fine. Looks like the main issue here is related to the model architecture and current composite model limitations rather than the RLS formula. Please follow below steps:

Please try to implement the RLS directly inside the original semantic model itself:

• Add the Profit Center RLS table into the original semantic model
• Create the relationship there and define the RLS role in that semantic model
• And then republish it.

Thanks and regards,

Anjan Kumar Chippa