RLS on a PowerBI semantic model - OneLake Catalog

Hi Carl,

This is a common area of confusion with Power BI semantic models and RLS, especially when using OneLake Catalog connections.

• RLS is enforced at the semantic model level. Any reports (child reports) you build off a published semantic model will inherit the RLS settings from the original model. You can’t create or edit RLS roles in these new/child reports.
  
  

• Workspace roles, only users with the Viewer role in the workspace will have RLS applied. If the user is an Admin, Member, or Contributor in that workspace, RLS will NOT apply—they’ll see all the data, regardless of your RLS setup.
  
  

How to verify RLS is working:

1. In the Power BI Service, open your semantic model’s Security page.

2. Use the Test as role feature to see exactly what a user assigned to a role will see.

3. If you have measures or visuals only in the child report, you can copy them into the main semantic model file for testing.

Hi Carl, when you connect a new report to a published semantic model with RLS, security roles from the semantic model should apply automatically, and users should only see data they're allowed to view. If users can see all the data, check if the RLS is properly set up and that the report is shared from a workspace where RLS is enforced, not bypassed. Sometimes, RLS is only active in supported environments (like Power BI Service), not always in local desktop or datasets shared incorrectly.
Did I answer your question? Mark my post as a solution!

You must perform these actions on the original semantic model, not the new report you created.

Find Your Semantic Model: In the Power BI Service, navigate to the workspace where you published your original semantic model.

Open Security Settings: Find the semantic model in the workspace list. Click the More options (...) menu and select Security.

Assign Members:

On the Row-Level Security page, you will see the list of roles you created in Power BI Desktop (e.g., "Regional Manager," "Sales Rep").

Select the role you want to assign users to.

In the text box, start typing the email addresses or security groups of the users who should belong to that role.

Click Add, and then make sure to click Save.

Test the Role (Crucial Step):

After saving, you can verify that the RLS is working correctly before asking your user to check again.

Click the More options (...) next to the role name and select Test as role.

A new browser tab will open showing a report view that is automatically filtered as if you were a member of that role. This allows you to confirm exactly what your users will see.

Once you have assigned the user to their role and saved the changes, they will see the correctly filtered, RLS-applied data the next time they open the report.

If this explanation and solution resolve your issue, please like and accept the solution.

Hi CarlBlunck ,

That is a peculiar situation. I have not worked with OneLake Catalog yet but we did make multiple reports off a single semantic model. And yes, the child reports inherit the RLS from the semantic model setup. Now here is the method I used to verify whether the RLS was properly setup: Download the semantic model report file, paste the visuals from the child report to the main report file, use the View As Role option to see everything was working as expected for that role, repeat. (If you have new measures in the child report, you could manually add them to the mother report as well or just use visuals that do not have such dependencies). 
Additionally, before you do all of the above, please verify the membership status of the user in the workspace (admins could be exempt from RLS) and if they have ownership of the dataset (owners could also be exempt).
Hope it helps!

Hi CarlBlunck ,

Thanks for posting in Microsoft Fabric Community.

I tested this scenario in my environment. I created a semantic model with RLS, published it, then built a new report by connecting to the model through the OneLake Catalog. I shared the report with a user who was assigned to an RLS role on the semantic model but was not added to the workspace. When they accessed the report, RLS was correctly applied and only the expected data was visible.

As rightly mentioned by others in this thread, the RLS roles need to be configured on the semantic model itself--not in the child report. Once users are added to the appropriate role under the model’s Security settings and changes are saved, RLS will apply. The “Test as role” option is helpful to verify what the user will see before sharing the report.

To clarify : RLS does work in child reports for users who are not part of the workspace, provided they are assigned to an RLS role and access the report through direct sharing or an app. Just make sure they don’t have Admin, Member, or Contributor access to the workspace, as that would override RLS.

References:

https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-roles-new-workspaces 

Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn

Solved: Re: RLS without workspace access - Microsoft Fabric Community

Also, since you mentioned earlier that you were planning to raise a support ticket - if you’ve already done that and received any clarification or resolution from the support team, it would be helpful if you could share the outcome here for the benefit of others following this thread.

Hope this helps. Please reach out for further assistance.

Thanks to everyone who shared valuable insights and contributed to this discussion.