RLS issue when a user belongs to multiple AAD groups

[Anonymous]

Hi all!

I am having some issues with my role-leve-security setup. 

My organization uses Azure Active Directory groups, which usually works fine. However, when a person belongs to multiple groups it soemtimes causes issues in Power BI.

For simplicity, let's say that my company has 2 employees. 

Brian is a consultant and belongs in the AAD group staff.all

Tina is a supervisor, so she belongs to the AAD groups staff.all and staff.supervisors

In Power BI, I have set up two roles: Staff and Supervisors

Brian should only see data belonging to him, so I have set a rule to the (Employees) table in the 'Staff role':

[email] = USERPRINCIPALNAME()

This works great, and Brian can only see himself on the project 'Cloud Migration'. 

Tina is a supervisor in Finland, so she should see all projects in Finland.  I have set a rule on the (Projects) table in the 'Supervisors role':

[Country] = "Finland"

This is where things go wrong. Tina still only sees the project she works for. If I remove Tina from staff.all, the issue goes away (but this is not an option). I have also tried adding '1 = 1' or 'TRUE()' to the Employees table for the 'Supervisors role'. Neither help.  

Has anyone experienced a similar issue and know of a way to solve this?

[parry2k]

@Anonymous based on your example, Tina would see only project 8 as that is the only one belongs to Finland, if you have more than two projects in Finland. Whcih roles you are enabling when you are testing RLS? 

[Anonymous]

Project 10 also belongs to Finland. No employees are assigned to it, but I still want Tina to see it. 

Shouldn't Power BI choose the least restrictive role or the role that returns the most data? 

[parry2k]

@Anonymous no, you have to tell which role to use, if you are using both the roles for Tina, you will not see project 10. There is no concept of least role or role that returns most of the data.

[Anonymous]

I think when you say "you have to tell which role to use", you are refering to the desktop feature "View as role", correct? But what about when the user actually logs in using his/her USERPRINCIPALNAME() and belongs to two different AD groups which have two different role-settings in PBI? 

[parry2k]

@Anonymous IN power bi service, you will add user to respective role, here is how to do this

[Anonymous]

Yes, of course this is done.

Here you see Tina's AAD roles. 

All users - staff.<country>.distribution on the picture, is the staff.all group I described in this post. They only see their own data using email = USERPRINCIPALNAME()

But when she belongs to two groups, it puts limitations on the data she sees.