Forum Discussion

lherbert501's avatar
lherbert501
Post Prodigy
5 months ago
Solved

Power BI Dataset RLS - Power BI Report Builder

Hi there,   I have a dataset created in Power BI. I created RLS on it and tested this against userprincipals and it works fine against a basic table in power bi.   I then created a paginated repo...
Need Help
  • v-ssriganesh's avatar
    v-ssriganesh
    4 months ago

    Hello lherbert501,
    When Power BI Report Builder connects to a Power BI semantic model, the dataset query is generated as DAX, but Microsoft documents that the executing user identity isn’t referenced directly inside the DAX text.

    Instead, the supported approach is:

    • Use the built‑in UserID field as the default value for a report parameter
    • Bind that parameter in the dataset filter or dataset parameter
    • The semantic model then evaluates its existing RLS rules using the passed user context

    Microsoft also documents that row‑level security rules including manager or hierarchy logic (for example PATH‑based relationships) are evaluated entirely within the semantic model. Report Builder does not implement or modify hierarchy logic; it only submits queries under the current user context. Once the semantic model applies RLS, all queries from the paginated report including those used for parameters return only the permitted rows.

    Thank you.

v-ssriganesh's avatar
v-ssriganesh
Community Support
4 months ago

Hi lherbert501,
Thank you for posting your query in the Microsoft Fabric Community Forum.

Please consider below:

  • Your RLS relies on USERPRINCIPALNAME(). It’s important to validate that the identity being evaluated at runtime matches what’s stored in DimUser[Email], as identity behavior can differ between Desktop testing and paginated report execution in the Power BI service.
  • If Team/User parameter datasets return all values, that typically indicates RLS isn’t being enforced for the executing user context rather than an issue with the parameter DAX itself.
  • If filtering needs to be explicitly enforced within Report Builder, Microsoft’s documented approach is to bind a report parameter to the built‑in UserID field and apply it in the dataset filter or query.

Helpful Microsoft documentation for reference:

If you can confirm what identity is being evaluated during paginated report execution, that should help isolate whether the issue is identity matching or RLS enforcement.

Best regards,
Ganesh Singamshetty.

  • lherbert501's avatar
    lherbert501
    Post Prodigy
    4 months ago

    Hi v-ssriganesh ,

     

    Thanks for this.

     

    It does indeed look like the Report builder Team/User parameter datasets return all values.

     

    How would I link the userprincipal that I know is working within PBI to the UserID field in report builder?

     

    If you can confirm what identity is being evaluated during paginated report execution, that should help isolate whether the issue is identity matching or RLS enforcement.

    - How would I achieve this? Put the userid field on the canvas on report builder?

     

    Thanks

     

    Liam

    • v-ssriganesh's avatar
      v-ssriganesh
      Community Support
      4 months ago

      Hi lherbert501,
      Thank you for your follow up.

      Yes, you can validate the identity used during paginated report execution by adding a textbox in Report Builder with:

      =User!UserID

      This displays the exact user identity passed at runtime. You can compare this value with what your RLS logic expects (i.e, USERPRINCIPALNAME() matching DimUser[Email]). If these values align, identity is flowing correctly.

      If your Team/User parameter datasets are still returning all values, that indicates RLS is not being enforced for the executing user context, rather than an issue with the parameter DAX itself.

      This step will help confirm whether the behavior is related to identity evaluation or RLS enforcement. For reference: Built-in Globals and User references in a paginated report - Microsoft Report Builder & Power BI Report Builder | Microsoft Learn

      • lherbert501's avatar
        lherbert501
        Post Prodigy
        4 months ago

        Hi v-ssriganesh ,

         

        Thanks again. So it looks like Report builder is passing the windows domain and power bi dataset is giving user principal. I've added in the domain as a column in the dataset.

         

        I'm a little bit lost on how to connect them together, however. Espeically with the manager path and path contains that I have.

         

        All I want is for the report builder user to carry through against their team from the dataset and show that team on the dropdown parameter.

         

        Thanks

         

        Liam