Forum Discussion
Resolver IRLS on a PowerBI semantic model - OneLake Catalog
Hi CarlBlunck ,
Thanks for providing the additional details.
RLS continues to work even if the report is published to a different workspace and then shared, so workspace-level access is not a factor here.
The USERPRINCIPALNAME() function always returns the signed-in user’s UPN. If that value does not exist in the workemail column of your security table, the filter evaluates to FALSE() for all rows, which results in the user seeing a blank report. This is the expected outcome since RLS only allows data access to users that are present in the filter table.
It is also important to ensure that the role you defined in Desktop is actually assigned in the Power BI Service. If the role is not assigned, the user effectively has no access, and the report will appear blank.
Finally, since there is a many-to-many relationship between the RLS filter tables, that can cause filters not to propagate correctly and lead to unexpected or empty results. Redesigning the model to avoid many-to-many relationships in the RLS filtering path is generally recommended.
Hope this helps. Please reach out for further assistance.
Thank you.
Super UserHi CarlBlunck ,
That is a peculiar situation. I have not worked with OneLake Catalog yet but we did make multiple reports off a single semantic model. And yes, the child reports inherit the RLS from the semantic model setup. Now here is the method I used to verify whether the RLS was properly setup: Download the semantic model report file, paste the visuals from the child report to the main report file, use the View As Role option to see everything was working as expected for that role, repeat. (If you have new measures in the child report, you could manually add them to the mother report as well or just use visuals that do not have such dependencies).
Additionally, before you do all of the above, please verify the membership status of the user in the workspace (admins could be exempt from RLS) and if they have ownership of the dataset (owners could also be exempt).
Hope it helps!
Super UserAdmins as well as contributors and members. RLS applies to those with a viewer role only.
CarlBlunckdanextian does this mean that the user must have a workspace viewer role? In my situation, I don't want the user to view the workspace, I only want them to access the report.
- Aburar_123
Solution Supplier
Hi CarlBlunck ,
If you have implemented the RLS then the RLS role users must have a viewer role in workspace. you can create a service app with limited reports if in case the user should not access all the reports in your workspace.
