Forum Discussion
RLS Issue - One user have multiple roles which overrides restrictive one
I have two Power BI dashboards—a Handler dashboard and a Manager dashboard—both built on the same dataset.
I’m encountering an issue with Row-Level Security (RLS). Some users are assigned both Handler and Manager roles. When these users access the Handler dashboard, the RLS for the Handler (lower) level does not work as expected, and they see data beyond their Handler-level scope.
Has anyone experienced this behavior in Power BI when using multiple report pages or dashboards with a single dataset and overlapping RLS roles? What is the recommended way to handle RLS in this scenario?
12 Replies
In Power BI, when a user belongs to multiple RLS roles on the same dataset:
Power BI applies OR logic across roles
The user gets the union of all rows allowed by any role
So if:
Handler role = restrictive
Manager role = broader
A user in both roles will always see Manager-level data, even when viewing a “Handler” report or dashboard.
RLS is evaluated at the dataset level, not per report, page, or dashboard.Instead of this you duplicate your dataset and implement different RLS levels for each dashboard you have.
What you see is working as designed. If you don't like that then either don't overlap roles/rules or as suggested by cengizhanarslan use separate reports.
Hi Anonymous,
Thank you for reaching out to the Microsoft Fabric Forum Community, and special thanks to cengizhanarslan and lbendlin for prompt and helpful responses.
In Power BI, this behavior is expected because Row-Level Security is always applied at the dataset level, not per report or dashboard. When a user belongs to multiple RLS roles, Power BI uses OR logic, so the user sees the least restrictive data, regardless of which report they open. There is no supported way to change RLS based on the report being accessed. When using a single enterprise dataset, the only practical workaround is to avoid overlapping roles by using one dynamic RLS role driven by a security table that determines a user’s effective access level. Other options like report separation or app audiences can improve user experience but do not provide real security. In short, with a centralized dataset, RLS must be designed so that each user has one clear data access scope.
Thanks & Regards,
Prasanna Kumar
Hello Anonymous
Why it happens!
In Power BI, if a user is a member of more than one RLS role on the same semantic model (dataset), Power BI evaluates them as the union (OR) of those roles. In practice, that often means the user gets the least restrictive access across the roles. So if your “Manager” role is broader than your “Handler” role, a user assigned to both will effectively see Manager-level data, even when viewing the Handler report.
This is independent of “pages” or “dashboards” RLS is enforced at the dataset level, not at the report/page level (as explained below, the same by Anonymous )
Recommended workaround: use an App + Audiences
If your main objective is:
“Certain people should only open the Handler report, and others should open the Manager report”
then the clean workaround is to publish both reports into a Power BI App and use Audiences:
How it helps
You can create Audience: Handlers and show only the Handler report/navigation to them.
You can create Audience: Managers and show only the Manager report/navigation to them.
Users assigned to both audiences can still be controlled by what you choose to expose in each audience.
This solves the UI and access-to-report problem (who can see which report), and it avoids confusion where a dual-role user opens the Handler report expecting Handler-level visibility.
Important limitation:
Audiences do not change RLS. If a user has Manager-level RLS on the dataset, they still have Manager-level visibility anywhere that dataset is used. Audiences control content visibility/access, not data-level filtering.
If the real requirement is “a Handler must not see other Handlers’ data”
That is a different requirement, and it must be solved via RLS design, not audiences.
Common patterns:
Single dynamic RLS role driven by a security table (UserPrincipalName → permission scope), rather than separate “Handler” and “Manager” roles that overlap.
Separate datasets (semantic models) if you truly need mutually exclusive security behavior for the same person depending on which report they open (because dataset-level RLS cannot “switch” per report).
Hey , as sadi earlier handler must see only handler data ..and we already have separate dataset to mitigate this issue ..i need workarounf Since we are going to build enterprise dataset (which can use all dashboards)
. I am trying explore or get ideas on Single dynamic RLS role options .
Columns i have in my dataset is Handler name .handler id , top manager id and EMail coulmns
Use separate reports.
Hi Anonymous,
This is a product limitation in Power BI. Even though you are using separate dashboards, both rely on the same dataset, and RLS is always evaluated at the dataset level using OR logic. If a user has multiple roles, the broader role will override the restrictive one, and this cannot be controlled or changed today. There is no practical workaround within a single enterprise dataset to enforce different RLS per dashboard. The only realistic options are to redesign security so users have one effective access level (dynamic RLS with no overlap) or to use separate datasets. If this behavior is a blocker, the best practical step is to raise it in the Power BI/Fabric Ideas forum to formally request report-level or role-priority RLS support.
Thanks & Regards,
Prasanna Kumar
Hi @Vasudevacv
Just following up to see if the Response provided by community members were helpful in addressing the issue. if the issue still persists Feel free to reach out if you need any further clarification or assistance.
Best regards,
Prasanna Kumar
