Forum Discussion
Power BI Dataset RLS - Power BI Report Builder
Hello lherbert501,
When Power BI Report Builder connects to a Power BI semantic model, the dataset query is generated as DAX, but Microsoft documents that the executing user identity isn’t referenced directly inside the DAX text.Instead, the supported approach is:
- Use the built‑in UserID field as the default value for a report parameter
- Bind that parameter in the dataset filter or dataset parameter
- The semantic model then evaluates its existing RLS rules using the passed user context
Microsoft also documents that row‑level security rules including manager or hierarchy logic (for example PATH‑based relationships) are evaluated entirely within the semantic model. Report Builder does not implement or modify hierarchy logic; it only submits queries under the current user context. Once the semantic model applies RLS, all queries from the paginated report including those used for parameters return only the permitted rows.
Thank you.
Hi v-ssriganesh ,
Thanks for this.
It does indeed look like the Report builder Team/User parameter datasets return all values.
How would I link the userprincipal that I know is working within PBI to the UserID field in report builder?
If you can confirm what identity is being evaluated during paginated report execution, that should help isolate whether the issue is identity matching or RLS enforcement.
- How would I achieve this? Put the userid field on the canvas on report builder?
Thanks
Liam
Hi lherbert501,
Thank you for your follow up.
Yes, you can validate the identity used during paginated report execution by adding a textbox in Report Builder with:
=User!UserIDThis displays the exact user identity passed at runtime. You can compare this value with what your RLS logic expects (i.e, USERPRINCIPALNAME() matching DimUser[Email]). If these values align, identity is flowing correctly.
If your Team/User parameter datasets are still returning all values, that indicates RLS is not being enforced for the executing user context, rather than an issue with the parameter DAX itself.
This step will help confirm whether the behavior is related to identity evaluation or RLS enforcement. For reference: Built-in Globals and User references in a paginated report - Microsoft Report Builder & Power BI Report Builder | Microsoft Learn
Hi v-ssriganesh ,
Thanks again. So it looks like Report builder is passing the windows domain and power bi dataset is giving user principal. I've added in the domain as a column in the dataset.
I'm a little bit lost on how to connect them together, however. Espeically with the manager path and path contains that I have.
All I want is for the report builder user to carry through against their team from the dataset and show that team on the dropdown parameter.
Thanks
Liam
Hello lherbert501,
Report Builder uses the built‑in User!UserID field, which typically returns the Windows identity for the user executing a paginated report.
RLS in a Power BI semantic model is evaluated using USERPRINCIPALNAME(), which returns the user’s UPN in the Power BI service.
Because these identity formats differ, they must be aligned in the semantic model for RLS to filter paginated report queries correctly. Once RLS is enforced at the model level, parameter datasets automatically return only RLS‑filtered values no additional filtering is required in Report Builder.