Forum Discussion
Power BI Dataset RLS - Power BI Report Builder
Hi there,
I have a dataset created in Power BI. I created RLS on it and tested this against userprincipals and it works fine against a basic table in power bi.
I then created a paginated report in report builder and used this dataset. When the users try to access the report it gives the below error. It ran fine pre RLS.
Hello lherbert501,
When Power BI Report Builder connects to a Power BI semantic model, the dataset query is generated as DAX, but Microsoft documents that the executing user identity isn’t referenced directly inside the DAX text.Instead, the supported approach is:
- Use the built‑in UserID field as the default value for a report parameter
- Bind that parameter in the dataset filter or dataset parameter
- The semantic model then evaluates its existing RLS rules using the passed user context
Microsoft also documents that row‑level security rules including manager or hierarchy logic (for example PATH‑based relationships) are evaluated entirely within the semantic model. Report Builder does not implement or modify hierarchy logic; it only submits queries under the current user context. Once the semantic model applies RLS, all queries from the paginated report including those used for parameters return only the permitted rows.
Thank you.
15 Replies
I tried reproducing the scenario, and I created a semantic model and implemented RLS on it. Created a paginated report and shared with a user appropriately. Meaning read permissions on the power bi semantic model and paginated report added the user into the semantic model RLS role . User is able to open the paginated report without any issues.
Let me know if I missed anything here. If not then I suggest you to check if the appropriate permissions on the semantic model and paginated report are shared with the users and users are added to the security role.
Connect on LinkedIn
You can read my articles here: https://www.techietips.co.in/
Did I answer your question? Mark my post as a solution! If I helped you, click on the Thumbs Up to give Kudos.
Proud to be a Super User!
Hi lherbert501
RLS with a Power BI semantic model and a paginated report is supported, so the issue is probably not that paginated reports “don’t work” with RLS. Microsoft’s guidance is that for RLS to work with Report Builder, the consuming users need at least Viewer access to the workspace that hosts the semantic model and Build permission on the semantic model/dataset. Build permission is also specifically required for paginated reports based on a semantic model.
I would check these items first:
Confirm the users opening the paginated report have Viewer on the workspace hosting the semantic model.
Confirm they also have Build permission on the semantic model/dataset, either directly or via app/workspace configuration.
Recreate the data source / dataset connection inside Report Builder and republish the RDL, because this generic Analysis Services connection error is often connection-related rather than an actual RLS-definition problem. Similar community cases show the same “Connection open intermittent error while reading in Analysis Services” message.
Ask the affected user to open See details and share the full error text, because the message shown in the screenshot is too generic to isolate the root cause.So my suspicion is: permissions first, report data source second, RLS logic third.
If this post helps, then please consider Accepting it as the solution to help the other members find it more quickly
Hi Ritaf1983 ,
Thankyou for your reply.
Just for a bit more context I have lets say factsales, dimuser and dimteam in my Power Bi dataset. This is what I have tested on using below and this works fine in PBI.
Role Dax
PATHCONTAINS(DimUser[Path], LOOKUPVALUE(DimUser[UserId], DimUser[Email],USERPRINCIPALNAME() ) )Moving to Power BI Report builder, I'm connecting to the datset and this is my team parameter dataset.TeamEVALUATE SELECTCOLUMNS (ADDCOLUMNS (SUMMARIZECOLUMNS (ROLLUPADDISSUBTOTAL ('DimTeam'[Teamname], "h0")), "ParameterLevel", if ([h0], 0, 1)), "ParameterCaption", SWITCH([ParameterLevel], 1, 'DimTeam'[Teamname], "Blank()"), "ParameterValue", 'DimTeam'[Teamname], "ParameterLevel", [ParameterLevel], "'DimTeam'[Teamname]", 'DimTeam'[Teamname]) order by 'DimTeam'[Teamname], [ParameterLevel]I then have my cascading user parameter:UserEVALUATE SUMMARIZECOLUMNS('DimUser'[Username], RSCustomDaxFilter(@DimTeamTeamname,EqualToCondition,[DimTeam].[Teamname],String), "total sales", [total sales]).The RLS from the dataset isn't passing through, and I'm wondering if its to do with the two parameters in Report builder. I have double checked and the user has read and build for the appropriate spaces.The error is now gone but the RLS just won't carry through for report builder.Is there anything you would recomend in either parameter datasets?Thankyou
Hi lherbert501,
Thank you for posting your query in the Microsoft Fabric Community Forum.Please consider below:
- Your RLS relies on USERPRINCIPALNAME(). It’s important to validate that the identity being evaluated at runtime matches what’s stored in DimUser[Email], as identity behavior can differ between Desktop testing and paginated report execution in the Power BI service.
- If Team/User parameter datasets return all values, that typically indicates RLS isn’t being enforced for the executing user context rather than an issue with the parameter DAX itself.
- If filtering needs to be explicitly enforced within Report Builder, Microsoft’s documented approach is to bind a report parameter to the built‑in UserID field and apply it in the dataset filter or query.
Helpful Microsoft documentation for reference:
- https://learn.microsoft.com/power-bi/paginated-reports/paginated-reports-rls
- Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn
- Built-In Globals and User References in a Paginated Report - Power BI | Microsoft Learn
If you can confirm what identity is being evaluated during paginated report execution, that should help isolate whether the issue is identity matching or RLS enforcement.
Best regards,
Ganesh Singamshetty.Hi v-ssriganesh ,
Thanks for this.
It does indeed look like the Report builder Team/User parameter datasets return all values.
How would I link the userprincipal that I know is working within PBI to the UserID field in report builder?
If you can confirm what identity is being evaluated during paginated report execution, that should help isolate whether the issue is identity matching or RLS enforcement.
- How would I achieve this? Put the userid field on the canvas on report builder?
Thanks
Liam
Hi lherbert501,
Thank you for your follow up.Yes, you can validate the identity used during paginated report execution by adding a textbox in Report Builder with:
=User!UserIDThis displays the exact user identity passed at runtime. You can compare this value with what your RLS logic expects (i.e, USERPRINCIPALNAME() matching DimUser[Email]). If these values align, identity is flowing correctly.
If your Team/User parameter datasets are still returning all values, that indicates RLS is not being enforced for the executing user context, rather than an issue with the parameter DAX itself.This step will help confirm whether the behavior is related to identity evaluation or RLS enforcement. For reference: Built-in Globals and User references in a paginated report - Microsoft Report Builder & Power BI Report Builder | Microsoft Learn
Hello lherbert501,
We hope you're doing well. Could you please confirm whether your issue has been resolved or if you're still facing challenges? Your update will be valuable to the community and may assist others with similar concerns.
Thank you.
Hello lherbert501,
Hope everything’s going great with you. Just checking in has the issue been resolved or are you still running into problems? Sharing an update can really help others facing the same thing.
Thank you.
Hi v-ssriganesh
I joined them both up in the semantic model the domain name and log in and it still doesn't pass through unfortunately
Hello lherbert501,
Thank you for confirming.
As per my understanding, even after aligning the identities in the semantic model, Microsoft documents that paginated reports are processed using the SSRS engine, and RLS filtering must be applied within Report Builder for the report queries.To apply RLS to parameter datasets (such as Team dropdowns), you need to create a report parameter using the built‑in User!UserID field and use that parameter in the dataset filter or query.
Reference: Set Up Row-Level Security in Power BI Paginated Reports - Power BI | Microsoft Learn
Hello lherbert501,
Could you please confirm if your query has been resolved by the provided solutions? This would be helpful for other members who may encounter similar issues.
Thank you for being part of the Microsoft Fabric Community.
