Forum Discussion
Resolver IRLS on a PowerBI semantic model - OneLake Catalog
Hi CarlBlunck ,
Thanks for providing the additional details.
RLS continues to work even if the report is published to a different workspace and then shared, so workspace-level access is not a factor here.
The USERPRINCIPALNAME() function always returns the signed-in user’s UPN. If that value does not exist in the workemail column of your security table, the filter evaluates to FALSE() for all rows, which results in the user seeing a blank report. This is the expected outcome since RLS only allows data access to users that are present in the filter table.
It is also important to ensure that the role you defined in Desktop is actually assigned in the Power BI Service. If the role is not assigned, the user effectively has no access, and the report will appear blank.
Finally, since there is a many-to-many relationship between the RLS filter tables, that can cause filters not to propagate correctly and lead to unexpected or empty results. Redesigning the model to avoid many-to-many relationships in the RLS filtering path is generally recommended.
Hope this helps. Please reach out for further assistance.
Thank you.
Super UserYou must perform these actions on the original semantic model, not the new report you created.
Find Your Semantic Model: In the Power BI Service, navigate to the workspace where you published your original semantic model.
Open Security Settings: Find the semantic model in the workspace list. Click the More options (...) menu and select Security.
Assign Members:
On the Row-Level Security page, you will see the list of roles you created in Power BI Desktop (e.g., "Regional Manager," "Sales Rep").
Select the role you want to assign users to.
In the text box, start typing the email addresses or security groups of the users who should belong to that role.
Click Add, and then make sure to click Save.
Test the Role (Crucial Step):
After saving, you can verify that the RLS is working correctly before asking your user to check again.
Click the More options (...) next to the role name and select Test as role.
A new browser tab will open showing a report view that is automatically filtered as if you were a member of that role. This allows you to confirm exactly what your users will see.
Once you have assigned the user to their role and saved the changes, they will see the correctly filtered, RLS-applied data the next time they open the report.
If this explanation and solution resolve your issue, please like and accept the solution.