Forum Discussion
PBI - Row Level Security for different user types
Hello,
I was able to create RLS for users so that the user logged on can only see their data when on a report. I did this by using the following code snippet:
[email] = userprincipalname()
However, depending on the user, I would like to make it so the USer can see ALL data. How is this possible?
For example:
IF Email ="johnDoe@test,com" or "[email protected]'
THEN "See all users data"
ELSE
"See my data only"
END
Hello bcap01
You can define user access in Power BI service.
Let's suppose that you defined 2 roles in Power BI desktop:
Director : global user who sees everything; you can use the "true()" function in the "Dax expression" tab
Salesperson: users who only see their data; for this one you have [email] = userprincipalname()
Publish the report and then, go to the "..." option of your dataset -> Security
and then specify the e-mail adresses or security groups for each role:
once the persons added, you can click on "..." near the role and "Test as role":
You'll be able to test as a specific person by providing its e-mail.
Can you try to do that?
Don't hesitate if smth's not clear.
Regards,
10 Replies
Hello bcap01
You can define user access in Power BI service.
Let's suppose that you defined 2 roles in Power BI desktop:
Director : global user who sees everything; you can use the "true()" function in the "Dax expression" tab
Salesperson: users who only see their data; for this one you have [email] = userprincipalname()
Publish the report and then, go to the "..." option of your dataset -> Security
and then specify the e-mail adresses or security groups for each role:
once the persons added, you can click on "..." near the role and "Test as role":
You'll be able to test as a specific person by providing its e-mail.
Can you try to do that?
Don't hesitate if smth's not clear.
Regards,
Many thanks! I have taken these steps, and what is strange is that it seems to generally work in Desktop, but then when I publish, the "Staff" level will show ALL data for the Staff member instead of just the data that applies to that stuff member. "Director" level shows all data as expected.
Hi bcap01
Can you try to test directly as "staff role"? without providing a person e-mail.
This is to check if there is the difference between the staff & director roles in terms of data.
Per info, there are cases when the RLS won't work. For example, when the specified person is an Admin, Member or Contributor of the workspace. Can you check the workspace access and identify the tested "staff member" permission?
Regards,
Hi bcap01,
From my understanding you created a role (lets call it role A). In role A you already defined the rule
[email] = userprincipalname()
and you also already assigned people to this role in the Power BI service so that they can only see the data which they are allowed to, correct?
Now you want additionally to give specific people the ability to see all data independent from their e-mail address. You can achive this by the following steps:
1. Please create a second role (we call it role B) in Power BI Desktop
2. in role B please do not put in any rules
3. Now again publish your report to the service
4. now assign all people to role B which shall see all data.
Result: Now all people assigned to role be should see all data.
Best regards
Michael
-----------------------------------------------------
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Appreciate your thumbs up!
@ me in replies or I'll lose your thread.
-----------------------------------------------------
Hi, For some reason my Roles seem to work in PowerBI Desktop, but when I Publish to Power BI Service, I assign users to the Two Roles, but in each case all data is being returned.
For example, "Leadership" is intended to see ALL data. "Staff" is intended to see their data only. "Leadership" and "Staff" for some reason both see all data. I have assigned folks to each group via PowerBI Service.
Is there anything at the Power BI Service level or Desktop that I may need to configure?
Hi bcap01
based on your description the approach I provided you should work. But to help you more I need the following indformation:
- date model picture with relevant tables and columns
- roles created incl. the rules per role
- people assigned to the rrole (can also be person a, person b person c etc.)
- expected behaviour vs. actual behaviour
Best regards
Michael
Best regards
Michael
-----------------------------------------------------
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Appreciate your thumbs up!
@ me in replies or I'll lose your thread.
-----------------------------------------------------
