Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Earn a 50% discount on the DP-600 certification exam by completing the Fabric 30 Days to Learn It challenge.

Reply
hinin
Frequent Visitor

Problems querying RLS Permissions

Problem

Query to $SYSTEM.TMSCHEMA_ROLE_MEMBERSHIPS is now returning an empty table for semantic model with RLS entries.

hinin_1-1708485490642.png

 

Background

  • I have a 10GB semantic model, deployed via a pipeline. The model uses incremental refresh (not that it should matter) 
  • Until recently I have had a report running that provided visibility of the RLS in that semantic model.
  • Recently (unclear when), the below query to get the membership for RLS roles stopped providing data; it still provides all the relevant fields though, just no values. 
let
#"Role Memberships" = AnalysisServices.Database(#"Workspace Name", #"Dataset Name", [Query="select * from $SYSTEM.TMSCHEMA_ROLE_MEMBERSHIPS", Implementation="2.0"])
in
#"Role Memberships"
  • The report still provides data for queries against $SYSTEM.TMSCHEMA_ROLES and $SYSTEM.TMSCHEMA_TABLE_PERMISSIONS, e.ghinin_4-1708486036549.png

     

  • RLS is still enforced and visible via SSMS/Tabular Editor/Power BI service/etc. 
  • The non-production instance of the semantic model still provides data for $SYSTEM.TMSCHEMA_ROLE_MEMBERSHIPS

hinin_3-1708485826450.png

 

Does anybody have any ideas? A complete rebuild/reload would be a fairly hefty undertaking so I'm trying to avoid.

Or is this going to be another MS ticket?

4 REPLIES 4
Marius94
New Member

We are facing the same issue. Did you find a way to solve the problem?

In short, nope. 

 

It's been a while, and was only put on the back burner due to other priorities, but I'll be raising with MS. 

v-xiandat-msft
Community Support
Community Support

Hi @hinin ,

there are a couple of avenues we can explore to address this issue without resorting to a complete rebuild or reload of your semantic model:

1. Check for Recent Changes: Since you mentioned that this issue has arisen recently, it would be beneficial to review any changes made to the semantic model or the environment. This includes updates to Power BI service, changes in the deployment pipeline, or modifications to the model itself. Sometimes, even minor changes can have unexpected impacts on system queries.

2. Validate Model Compatibility and Settings: Ensure that your semantic model and the Power BI environment are fully compatible with the latest updates and features. Specifically, verify if there have been any updates or changes in how Power BI handles system queries for semantic models with RLS. The documentation on [Row-Level Security (RLS) permissions in Power BI](https://learn.microsoft.com/en-us/power-bi/developer/embedded/generate-embed-token) and [Power BI implementation planning for security](https://learn.microsoft.com/en-us/power-bi/guidance/powerbi-implementation-planning-security-report-...) might provide some insights into any recent changes or requirements.

Best Regards,

Xianda Tang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Unforunately this doesn't help.

 

  1. None of the changes seem relevant. Per the initial description (although with some clarification), the definition is identical (including metadata) to that in non-production, and that is still functioning fine.
  2. See above- the exact same model functions perfectly fine in the Test part (workspace) of the Deployment Pipeline, even if directed to pull data off Production datasets, so environments are the "same", albeit functional in one instance and not in the other. 

On a direct model-model comparison, the only differences are the id GUID, the RLS member entries, and a couple of Parameter values.

 

It's not a new model, and any recent changes have largely been very well understood (such as adjusting a measure's filters or redirecting to pull an incidental lookup table from a different data source) and should not impact the RLS.

Helpful resources

Announcements
RTI Forums Carousel3

New forum boards available in Real-Time Intelligence.

Ask questions in Eventhouse and KQL, Eventstream, and Reflex.

MayPowerBICarousel

Power BI Monthly Update - May 2024

Check out the May 2024 Power BI update to learn about new features.

LearnSurvey

Fabric certifications survey

Certification feedback opportunity for the community.