RLS row level security - not showing online

[Anonymous]

Hi Everyone -  I have created the following role in my sales table.   

[Salesperson (groups)] = "HSRs"

In the online enviornment, if I choose "test role", it works perfectly and only shows the 5 sales people (the HSR team) affiliated with their sales.     I can see it using "test role", but the actual users still see ALL of the other sales teams' information.  

Even though in the online service I have added their email addresses to this role.   

Any suggestions?    I have also tested this with a single user, and using the UPN value, and the same thing.   I can test the role perfectly fine....but the actual users are still seeing all of the information...not just their own information which is what they should see.  

What would cause the "test role" enviornment to work, but not actually show correctly to the other users?    

[jdbuchanan71]

Hello @Anonymous 

Are the users in question members of the workspace?  If so, RLS doesn't restrict their data.

https://docs.microsoft.com/en-us/power-bi/service-admin-rls

If this is the case, rather than makeing them members of the workspace you should just share the report with them.

[Anonymous]

Yes, they are.   It is a premium workspace and they are members of it.   

The data is imported from Excel, and lives in OneDrive.  

[jdbuchanan71]

Then RLS won't be applied.

[Anonymous]

Oh, Ok.    So what is the best solution to sharing a report with a large group of people (35).   But only showing certain teams their information?   

[Anonymous]

Should I publish to an "App"  instead?  

[jdbuchanan71]

You can or you can just share the report with them.  It's just that the users you want RLS to apply to cannot be members of the workspace.

[Anonymous]

So if I publish it to an App, will the RLS be applied?  

Or perhaps I could move the report to a different location....one where these members are not a part of....for example my own workspace which is also premium, and then the RLS would apply?   

[jdbuchanan71]

No, publishing the app will not apply RLS because the users are members of the workspace.

Why not just remove them as users on the workspace?  You should not have users who should have restricted access as members of the workspace.  Members of the workspace have access to all the data sets and date in the workspace.

If you do need to move the report to another workspace you should not use your personal workspace, just have the PowerBI admin create another workspace and add it to the premium capacity.

[Anonymous]

First.....Thank you for your help!!   It's already been super helpful as I'm going to be working all weekend on this report. 

The workspace was automatically created via a Microsoft Team that was created.    We have 5 sales teams that need to see the report...plus executives that want to see the total report.   The 5 sales teams of course just need to see their areas...but the execs want to see the full report.  

So, I could create a new premium workspace...or upload the report to another premium workspace that we have already that they are not members of...and then the RLS would work, correct?  

[jdbuchanan71 · Accepted solution]

That's correct, it's just them being members that is causing RLS to be ignored.

[Anonymous]

Thank you!   Just tested it and everything is working properly at the team level.   

I've seen some good tutorials on how to apply a "path" if I wanted to go from Manager...down to sales people...to see a hiearchy in the sales team.  Will tackle that next.    

I will mark this thread as solved!  

[jdbuchanan71]

You should also create and executive role where no filters are applied.  With RLS enabled, if a user that is not in a role and is not a member of the workspace goes to view the report they will see nothing.

Or you could make the execs members of the workspace.

[Anonymous]

That is great to know....as it is exactly a requirement I will have.