RLS in Power BI Desktop with Power BI service as data source

[olF]

Hi all,

I have built a report and dataset with RLS setting. 

I want to share this dataset to colleagues so that they can connect to this dataset through Power BI Desktop to do some adhoc reporting by themselves. 

They can connect to the dataset through their PBI Desktop, but seems like the RLS is not working?

May I know if RLS can be applied to this situation? Or anything missed here?

Look forward to any comments. Thanks

[olF]

Thanks @TomMartens Tom and  @v-lili6-msft Lin. Very clear now.

I used @v-lili6-msft suggestion to add users as "Viewer" and grant them "build" right. It works for newly added users.

But I found that, once I have granted "Contributor" or "Member" access to users before, if I change them to be "Viewer" now, they will still be able to read all data instead of restricted data that within RLS.

Don't know if it is something related to the setting of workspace or not.

[v-lili6-msft]

hi @olF 

---

@olF wrote:

Thanks @TomMartens Tom and  @v-lili6-msft Lin. Very clear now.

I used @v-lili6-msft suggestion to add users as "Viewer" and grant them "build" right. It works for newly added users.

But I found that, once I have granted "Contributor" or "Member" access to users before, if I change them to be "Viewer" now, they will still be able to read all data instead of restricted data that within RLS.

Don't know if it is something related to the setting of workspace or not.

---

I have tested on my side, it works well.

After change them to be "Viewer" , Please wait about 5 minutes then reopen the power bi service and power bi desktop to check it.

It should work well.

Regards,

Lin

[v-lili6-msft · Accepted solution]

hi @olF 

First, you should know that RLS only works for viewer users

Using RLS with workspaces in Power BI

If you publish your Power BI Desktop report to a workspace within the Power BI service, the roles will be applied to read-only members. You will need to indicate that members can only view Power BI content within the workspace settings.

 Warning

If you have configured the workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data.

https://docs.microsoft.com/en-us/power-bi/service-admin-rls#using-rls-with-workspaces-in-power-bi

Second, for your case, you could add users that only could view power bi content and then give them the permissions of this dataset to create the report.

https://docs.microsoft.com/en-us/power-bi/service-datasets-build-permissions

Regards,

Lin

[TomMartens]

Hey,

I do not understand how do you share the dataset.

If you distribute your pbix to the users, RLS will not work.

If you publish your pbix to a dedicated workspace, RLS can work, if this is configured:

The users have to be assigned to the "Viewer" role, if the users are contributor, member, or admin RLS will not work.

The users need build permission on the dataset, to be able to Create their own reports with Power BI Desktop. Being a "Viewer" also means that the users are not able to publish their reports to the same workspace that hosts the dataset. If the workspace is not backed by a Premium Capacity the "Viewer" also need a Pro License to connect to the workspace.

Please be aware, that I did not test this myself, but will do it the next week.

Regards,

Tom