Forum Discussion
RLS Issue - One user have multiple roles which overrides restrictive one
Hi Anonymous,
Thank you for reaching out to the Microsoft Fabric Forum Community, and special thanks to cengizhanarslan and lbendlin for prompt and helpful responses.
In Power BI, this behavior is expected because Row-Level Security is always applied at the dataset level, not per report or dashboard. When a user belongs to multiple RLS roles, Power BI uses OR logic, so the user sees the least restrictive data, regardless of which report they open. There is no supported way to change RLS based on the report being accessed. When using a single enterprise dataset, the only practical workaround is to avoid overlapping roles by using one dynamic RLS role driven by a security table that determines a user’s effective access level. Other options like report separation or app audiences can improve user experience but do not provide real security. In short, with a centralized dataset, RLS must be designed so that each user has one clear data access scope.
Thanks & Regards,
Prasanna Kumar
Hello Anonymous
Why it happens!
In Power BI, if a user is a member of more than one RLS role on the same semantic model (dataset), Power BI evaluates them as the union (OR) of those roles. In practice, that often means the user gets the least restrictive access across the roles. So if your “Manager” role is broader than your “Handler” role, a user assigned to both will effectively see Manager-level data, even when viewing the Handler report.
This is independent of “pages” or “dashboards” RLS is enforced at the dataset level, not at the report/page level (as explained below, the same by Anonymous )
Recommended workaround: use an App + Audiences
If your main objective is:
“Certain people should only open the Handler report, and others should open the Manager report”
then the clean workaround is to publish both reports into a Power BI App and use Audiences:
How it helps
You can create Audience: Handlers and show only the Handler report/navigation to them.
You can create Audience: Managers and show only the Manager report/navigation to them.
Users assigned to both audiences can still be controlled by what you choose to expose in each audience.
This solves the UI and access-to-report problem (who can see which report), and it avoids confusion where a dual-role user opens the Handler report expecting Handler-level visibility.
Important limitation:
Audiences do not change RLS. If a user has Manager-level RLS on the dataset, they still have Manager-level visibility anywhere that dataset is used. Audiences control content visibility/access, not data-level filtering.
If the real requirement is “a Handler must not see other Handlers’ data”
That is a different requirement, and it must be solved via RLS design, not audiences.
Common patterns:
Single dynamic RLS role driven by a security table (UserPrincipalName → permission scope), rather than separate “Handler” and “Manager” roles that overlap.
Separate datasets (semantic models) if you truly need mutually exclusive security behavior for the same person depending on which report they open (because dataset-level RLS cannot “switch” per report).
Hey , as sadi earlier handler must see only handler data ..and we already have separate dataset to mitigate this issue ..i need workarounf Since we are going to build enterprise dataset (which can use all dashboards)
. I am trying explore or get ideas on Single dynamic RLS role options .
Columns i have in my dataset is Handler name .handler id , top manager id and EMail coulmns