Object level security explained

[rebeccaETE]

Hi all, 

I'm looking into using Object Level Security (OLS) for a table in my data model but I can't wrap my head around the security roles. In all the videos I've seen on how to set-up OLS, they create a security group for "cannot view sensitive data", and then change the OLS to "None" for those users.

In my eyes, it would make more sense to create a "can view sensitive data" and set it to "Read" - and as a default every user not in that group cannot see the table. However, the default is currently equivalent to "read", so I don't see how you could do this.

The reason I'm worried is the management of it all. What I need is to publish the dataset to a workspace and subsequently publish to an app, which several distribution groups have access to. I can easily add the current distributions groups that should not be able to view the data into a "cannot view sensitive data" security group. But what happens if I suddenly create a new distribution group and grant them access to the app but forget to put them in the security group? Can they then see the data as a default? That seems risky to me. 

Can anyone help explain this set-up to me? 

Cheers 

Rebecca 

[v-henryk-mstf]

Hi @rebeccaETE ,

See if the following blog links are helpful to you.

Announcing public preview of Object-Level Security in Power BI | Microsoft Power BI Blog | Microsoft...

If the problem is still not resolved, please point it out. Looking forward to your reply.

Best Regards,
Henry

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[rebeccaETE · Accepted solution]

@v-henryk-mstf Hi Henry, 
Thanks for the link, I've already read it (and many others 😅) 

What I was unsure of - and couldn't seem to decipher from the blog posts - was whether someone not in any of the security roles could see the objects as a default. But I tested this yesterday, and found that if it's not specified whether an employee should see or not see the objects by OLS, then they can't access the report at all (it throws an error saying something like RLS is blocking access). If I put the employee in the "cannot see" OLS role, he could see only the visuals from un-secured objects in the report. And lastly, he could see everything when allocated the "can see" OLS role. 

So, some good-old fashion testing answered my question. I will close this post. 

Thanks 

[amitchandak]

@rebeccaETE ,

Have you checked if sensitivity label or masking can help?

https://docs.microsoft.com/en-us/power-bi/admin/service-security-apply-data-sensitivity-labels

https://radacad.com/secure-the-sensitive-data-in-power-bi-data-masking-better-with-row-level-securit...

[rebeccaETE]

@amitchandak Yes, the thing is that I do want to restrict access to the content, and as I can gather with: 

Masking: "Sometimes, you want to show all the information to all the users, but you want to hide the sensitive data"- I don't want to show all the information to all the users. I want them to see nothing at all, if they don't have the right access level. 

and 

Sensitivity labels: "In the Power BI service, sensitivity labeling does not affect access to content. " - I do want to affect access.