Forum Discussion
RLS issue when a user belongs to multiple AAD groups
Hi all!
I am having some issues with my role-leve-security setup.
My organization uses Azure Active Directory groups, which usually works fine. However, when a person belongs to multiple groups it soemtimes causes issues in Power BI.
For simplicity, let's say that my company has 2 employees.
Brian is a consultant and belongs in the AAD group staff.all
Tina is a supervisor, so she belongs to the AAD groups staff.all and staff.supervisors
In Power BI, I have set up two roles: Staff and Supervisors
Brian should only see data belonging to him, so I have set a rule to the (Employees) table in the 'Staff role':
[email] = USERPRINCIPALNAME()
This works great, and Brian can only see himself on the project 'Cloud Migration'.
Tina is a supervisor in Finland, so she should see all projects in Finland. I have set a rule on the (Projects) table in the 'Supervisors role':
[Country] = "Finland"
This is where things go wrong. Tina still only sees the project she works for. If I remove Tina from staff.all, the issue goes away (but this is not an option). I have also tried adding '1 = 1' or 'TRUE()' to the Employees table for the 'Supervisors role'. Neither help.
Has anyone experienced a similar issue and know of a way to solve this?
6 Replies
- parry2k
Super User
Anonymous based on your example, Tina would see only project 8 as that is the only one belongs to Finland, if you have more than two projects in Finland. Whcih roles you are enabling when you are testing RLS?
- parry2k
Anonymous no, you have to tell which role to use, if you are using both the roles for Tina, you will not see project 10. There is no concept of least role or role that returns most of the data.
