RLS not applying to all visuals despite relationships across multiple tables

[HamidBee]

Hi all,

 

I’ve set up Row-Level Security (RLS) in my Power BI model, but it’s not being applied to all visuals especially those based on data from my Payments and PORequests tables.

Here’s my data model structure (see attached screenshot):

• RLS → connected to Division via ServiceCode (single-direction, one-to-many)

• Division → BU (via CC)

• BU → PORequests (via BudgetCC)

• PORequests → Payments (via Inv Ref)

  The above are all essentially excel tables. 

  My RLS rule is defined on the RLS table as:

  [Email] = USERPRINCIPALNAME()

  The issue: when I test “View as role" is that some visuals still show even if the user has been assigned a service code that does not even exist.

  Could this be due to relationships preventing filter propagation from the RLS table through the rest of the model?

  
  Would enabling bidirectional filtering between some of these tables (e.g. Division–BU, BU–PORequests, PORequests–Payments) be the correct approach, or is there a better way to handle RLS across multiple related fact tables?

  Thanks in advance for any help.

[v-karpurapud]

Hi @HamidBee 

I wanted to follow up to see if the guidance provided was helpful for you. If so, hope it will also benefit others seeking similar information. If you have any further questions or need additional clarification, please feel free to contact me.

Thank you.

[v-karpurapud]

Hi @HamidBee 

Thanks for reaching out to the Microsoft fabric community forum. 

I would like to express my appreciation @vojtechsima  for your active participation in the community forum and for the valuable solutions you have shared. Your contributions have a significant impact.

I hope the information provided will assist you in resolving the issue. If you have further questions or require additional assistance, please do not hesitate to reach out. We are here to support you.

Best Regards, 
Community Support Team.

[vojtechsima]

Hey, @HamidBee ,

• RLS → connected to Division via ServiceCode (single-direction, one-to-many)  this actually isn'T applied, you have both-direction.

With both directions, even tho not the best, should apply the filters as you wanted, because the rest flows in direction properly.

The only thing is that subsequent tables cannot filter the tables "above", for example, Payments cannot filter PORequests.

But in your case the issue that you likely don't have applied Secure filtering on both sides, so check this and it should work.

[HamidBee]

Thanks for your reply. I'd just add some additional context and correct some mistakes I had made in my description:

• RLS → connected to Division via ServiceCode (cross flter both direction and apply security filter in both directions)

In the RLS table I have assigned 'James@companyname.com' with a service code that does not exist in the 'Division' table. When I view as this user in PBI Desktop, I can't see the data in the 'Division' or 'BU' table but for some reason I can see all the data in the 'Payments' and the PORequests' table.

[vojtechsima · Accepted solution]

Hey @HamidBee ,
I built something similar,

Do you check for the user rights like this?

Because when I do this, I cannot see anything in all tables when I suggest a user that doesn't exist anywhere or if the division does not exist in both.

The only thing that perhaps could cause this that you have some blanks in your keys, therefore it could acts as valid relationship? It feels very strange if your setup is exactly as you showed.

Feel free to check my file and test it.