Forum Discussion
Resolver IIIRLS with Multiple Role Purposes
Anonymous
The documentation may indicate that they are additive, whch was also my assumption. But I can assure you the results are not consistent with that behavior.
I implemented the dimension A as a individual roles and then added the same DAX to filter dimension B to each role and used dynamic RLS with associated user/user profile tables in order to combine them correctly. This is a very limiting implementation of roles and accurately combining roles should be possible. There was no overlap of DAX filters between roles also it should work.
Hi m-colbert ,
Based on the test the result in this case should be the union of role A and role B.
After further digging, I found the answer to this question from the documentation:
//When a report user is assigned to multiple roles, RLS filters become additive. It means report users can see table rows that represent the union of those filters.
This description is consistent with our description and test results, so this should be how he works.
The document also described best practices when creating roles:
//When you're considering the permission needs for a single report user, strive to create a single role that grants all those permissions, instead of a design where a report user will be a member of multiple roles. It's because a report user could map to multiple roles, either directly by using their user account or indirectly by security group membership. Multiple role mappings can result in unexpected outcomes.
Therefore, you need to choose between creating fewer roles or achieving the desired effect.😞
For your reference: Row-level security (RLS) guidance in Power BI Desktop
Best Regards,
Gao
Community Support Team
If there is any post helps, then please consider Accept it as the solution to help the other members find it more quickly. If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!
How to get your questions answered quickly -- How to provide sample data
Resolver IIIAnonymous
The documentation may indicate that they are additive, whch was also my assumption. But I can assure you the results are not consistent with that behavior.
I implemented the dimension A as a individual roles and then added the same DAX to filter dimension B to each role and used dynamic RLS with associated user/user profile tables in order to combine them correctly. This is a very limiting implementation of roles and accurately combining roles should be possible. There was no overlap of DAX filters between roles also it should work.