Power BI Dataset RLS - Power BI Report Builder

[lherbert501]

Hi there,

I have a dataset created in Power BI. I created RLS on it and tested this against userprincipals and it works fine against a basic table in power bi.

I then created a paginated report in report builder and used this dataset. When the users try to access the report it gives the below error. It ran fine pre RLS.

[v-ssriganesh]

Hello @lherbert501,

We hope you're doing well. Could you please confirm whether your issue has been resolved or if you're still facing challenges? Your update will be valuable to the community and may assist others with similar concerns.

Thank you.

[v-ssriganesh]

Hi @lherbert501,
Thank you for posting your query in the Microsoft Fabric Community Forum.

Please consider below:

• Your RLS relies on USERPRINCIPALNAME(). It’s important to validate that the identity being evaluated at runtime matches what’s stored in DimUser[Email], as identity behavior can differ between Desktop testing and paginated report execution in the Power BI service.
• If Team/User parameter datasets return all values, that typically indicates RLS isn’t being enforced for the executing user context rather than an issue with the parameter DAX itself.
• If filtering needs to be explicitly enforced within Report Builder, Microsoft’s documented approach is to bind a report parameter to the built‑in UserID field and apply it in the dataset filter or query.

Helpful Microsoft documentation for reference:

• https://learn.microsoft.com/power-bi/paginated-reports/paginated-reports-rls
• Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn
• Built-In Globals and User References in a Paginated Report - Power BI | Microsoft Learn

If you can confirm what identity is being evaluated during paginated report execution, that should help isolate whether the issue is identity matching or RLS enforcement.

Best regards,
Ganesh Singamshetty.

[lherbert501]

Hi @v-ssriganesh ,

Thanks for this.

It does indeed look like the Report builder Team/User parameter datasets return all values.

How would I link the userprincipal that I know is working within PBI to the UserID field in report builder?

If you can confirm what identity is being evaluated during paginated report execution, that should help isolate whether the issue is identity matching or RLS enforcement.

- How would I achieve this? Put the userid field on the canvas on report builder?

Thanks

Liam

[v-ssriganesh]

Hi @lherbert501,
Thank you for your follow up.

Yes, you can validate the identity used during paginated report execution by adding a textbox in Report Builder with:

=User!UserID

This displays the exact user identity passed at runtime. You can compare this value with what your RLS logic expects (i.e, USERPRINCIPALNAME() matching DimUser[Email]). If these values align, identity is flowing correctly.

If your Team/User parameter datasets are still returning all values, that indicates RLS is not being enforced for the executing user context, rather than an issue with the parameter DAX itself.

This step will help confirm whether the behavior is related to identity evaluation or RLS enforcement. For reference: Built-in Globals and User references in a paginated report - Microsoft Report Builder & Power BI Rep...

[lherbert501]

Hi @v-ssriganesh ,

Thanks again. So it looks like Report builder is passing the windows domain and power bi dataset is giving user principal. I've added in the domain as a column in the dataset.

I'm a little bit lost on how to connect them together, however. Espeically with the manager path and path contains that I have.

All I want is for the report builder user to carry through against their team from the dataset and show that team on the dropdown parameter.

Thanks

Liam

[v-ssriganesh]

Hello @lherbert501,

Report Builder uses the built‑in User!UserID field, which typically returns the Windows identity for the user executing a paginated report.

RLS in a Power BI semantic model is evaluated using USERPRINCIPALNAME(), which returns the user’s UPN in the Power BI service.

Because these identity formats differ, they must be aligned in the semantic model for RLS to filter paginated report queries correctly. Once RLS is enforced at the model level, parameter datasets automatically return only RLS‑filtered values no additional filtering is required in Report Builder.

[Ritaf1983]

Hi @lherbert501 

RLS with a Power BI semantic model and a paginated report is supported, so the issue is probably not that paginated reports “don’t work” with RLS. Microsoft’s guidance is that for RLS to work with Report Builder, the consuming users need at least Viewer access to the workspace that hosts the semantic model and Build permission on the semantic model/dataset. Build permission is also specifically required for paginated reports based on a semantic model.

I would check these items first:

Confirm the users opening the paginated report have Viewer on the workspace hosting the semantic model.
Confirm they also have Build permission on the semantic model/dataset, either directly or via app/workspace configuration.
Recreate the data source / dataset connection inside Report Builder and republish the RDL, because this generic Analysis Services connection error is often connection-related rather than an actual RLS-definition problem. Similar community cases show the same “Connection open intermittent error while reading in Analysis Services” message.
Ask the affected user to open See details and share the full error text, because the message shown in the screenshot is too generic to isolate the root cause.

So my suspicion is: permissions first, report data source second, RLS logic third.

If this post helps, then please consider Accepting it as the solution to help the other members find it more quickly

[lherbert501]

Hi @Ritaf1983 ,

Thankyou for your reply.

Just for a bit more context I have lets say factsales, dimuser and dimteam in my Power Bi dataset. This is what I have tested on using below and this works fine in PBI.

Role Dax

PATHCONTAINS(DimUser[Path], LOOKUPVALUE(DimUser[UserId], DimUser[Email],USERPRINCIPALNAME() ) )

Moving to Power BI Report builder, I'm connecting to the datset and this is my team parameter dataset.

Team

EVALUATE SELECTCOLUMNS (ADDCOLUMNS (SUMMARIZECOLUMNS (ROLLUPADDISSUBTOTAL ('DimTeam'[Teamname], "h0")), "ParameterLevel", if ([h0], 0, 1)), "ParameterCaption", SWITCH([ParameterLevel], 1, 'DimTeam'[Teamname], "Blank()"), "ParameterValue", 'DimTeam'[Teamname], "ParameterLevel", [ParameterLevel], "'DimTeam'[Teamname]", 'DimTeam'[Teamname]) order by 'DimTeam'[Teamname], [ParameterLevel]

I then have my cascading user parameter:

User

EVALUATE SUMMARIZECOLUMNS('DimUser'[Username], RSCustomDaxFilter(@DimTeamTeamname,EqualToCondition,[DimTeam].[Teamname],String), "total sales", [total sales]).

The RLS from the dataset isn't passing through, and I'm wondering if its to do with the two parameters in Report builder. I have double checked and the user has read and build for the appropriate spaces.

The error is now gone but the RLS just won't carry through for report builder.

Is there anything you would recomend in either parameter datasets?

Thankyou

[tharunkumarRTK]

@lherbert501 

I tried reproducing the scenario, and I created a semantic model and implemented RLS on it. Created a paginated report and shared with a user appropriately. Meaning read permissions on the power bi semantic model and paginated report added the user into the semantic model RLS role . User is able to open the paginated report without any issues. 

Let me know if I missed anything here. If not then I suggest you to check if the appropriate permissions on the semantic model and paginated report are shared with the users and users are added to the security role.

Connect on LinkedIn

You can read my articles here: https://www.techietips.co.in/

Did I answer your question? Mark my post as a solution!
If I helped you, click on the Thumbs Up to give Kudos. Proud to be a Super User!