RLS is showing incorrect numbers

[karnott]

I have created a report that has a seperate page for each OpCo to see their device count for 3 applications. There is a spreadsheet source for each application - Countercept, Sophos and MDE - rather than one big spreadsheet. I have applied RLS by creating a role for each OpCo and filtering the role so that they can only see data on their page and the other pages will appear blank. When viewing the report as one of these OpCo roles, it seems to have worked as all other pages are blank, but for some reason the data they're seeing on their page is not correct. Any reason as to why the numbers aren't showing correctly?

Here are the roles I have applied in PowerBi, I then went on to the semantic model in PowerBi online and applied the security roles to users.

Please see the first image of the ArcTouch page showing what the numbers look like.

Then the second image showing what the numbers look like for users assigned to the ArcTouch role.

[raji_n]

@karnott what is the level of access that the users have for that workspace? if they have member access they might most likely see all the values, as opposed to those with viewer access.

Thanks,

Raji

If my post helped, please mark that as solution 🙂

[karnott]

Hi,

Sorry for the delayed response. They have view/read access as they don't need to be able to edit the report.

[v-xianjtan-msft]

Hi @karnott 

I would like to confirm the following with you:

1. Has your RLS taken effect, but the device count numbers are not displaying correctly?
2. Is the "device count for 3 applications" like "ArcTouch CC" a measure you created? Can you share the DAX for these measures?
3. Can you please share some dummy data or snapshots that keep the data structure and tables relationships? Please take care to protect your data privacy.

^{Best Regards,}

^{Jarvis Tang}

^{If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.}

[karnott]

Hi @v-pn,

1. Yes RLS has been applied as pages each user don't need to see are blank but the device count is not showing correctly for their page. I.e. ArcTouch can't see the data on the other OpCo pages but the data on their page is showing incorrect numbers as the image above shows.

2. No, no measures have been used. It is simply 3 sets of data and then the tables for each application have a filter applied so only devices for that OpCo are shown.

[v-xianjtan-msft · Accepted solution]

Hi @karnott 

Thank you for the more detailed information, please try the following steps to see if they help.
1. After creating RLS roles in Power BI Desktop, use the "View as" feature to validate the RLS results.
If RLS works and the device count are displayed correctly, then verify the workspace permissions of the role members as mentioned by raji_n above. RLS roles doesn’t apply to members who are assigned to the Admin, Member, or Contributor role in the workspace. Please refer to:https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security#using-rls-with-wo...

2. If it fails to validate the RLS effect using the "View as" feature in Power BI Desktop.
It is likely that the relationship between the tables and the settings of the page filters are causing the device counts to display abnormally.
In my simple test, no relationships are set up between the tables and page filtering is performed using the SubOpCo field in each of the three tables. This way the RLS I have set up seems to work correctly.

If your problem still exists, please let me know how you set up the relationship between the tables and the filtering of the pages or tables.

Best Regards,
Jarvis Tang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[karnott]

Perfect! The tables were linked and now I've deleted the relationships, the numbers are viewing correctly! Thank you so much Jarvis 🙂