Row Level Security All Users

[Anonymous]

I'm designing our row level security for our dashboards and have come up with a slight issue. We are trying to create a single set of dashboards that can be deployed to all users in the company. Then we'd use row level security to limit what they can actually see. The concept is to have an icon for each report. If the user doesn't have access, the icon changes to a "Access Denied" icon.

I've got this working as long as the user is assigned SOME role in the RLS by using a formula like this:

Access = if(count('tablewithdata'[keyfield])=0,CALCULATE(max(Images[URL]), filter(Images, Images[Index]="Access_Denied")), CALCULATE(max(Images[URL]), filter(Images, Images[Index]="Lost_Hours")))

Then using an image visualization to show the URL for the image.

My problem is if the user has no role at all, it gives me an error rather than an image. I was expecting the count to return 0, rather than an error. Is there:

A) a way to get the if to return true if there are no records or if the user has no access at all

B) setup a catch-all role (ie, ALL users are a member of that role)

C) some other way to display a specific image if the user has no access?

[Eric_Zhang · Accepted solution]

---

@Anonymous wrote:

I'm designing our row level security for our dashboards and have come up with a slight issue. We are trying to create a single set of dashboards that can be deployed to all users in the company. Then we'd use row level security to limit what they can actually see. The concept is to have an icon for each report. If the user doesn't have access, the icon changes to a "Access Denied" icon.

I've got this working as long as the user is assigned SOME role in the RLS by using a formula like this:

Access = if(count('tablewithdata'[keyfield])=0,CALCULATE(max(Images[URL]), filter(Images, Images[Index]="Access_Denied")), CALCULATE(max(Images[URL]), filter(Images, Images[Index]="Lost_Hours")))

Then using an image visualization to show the URL for the image.

My problem is if the user has no role at all, it gives me an error rather than an image. I was expecting the count to return 0, rather than an error. Is there:

A) a way to get the if to return true if there are no records or if the user has no access at all

B) setup a catch-all role (ie, ALL users are a member of that role)

C) some other way to display a specific image if the user has no access?

---

@Anonymous

It is by design that Power BI gives error when a user has no role accesses a RLS dataset. The RLS blocks user access before counting 0, not to mention returning an image url. To make your measure work, the users have to be a RLS role. AFAIK, there's no way for your Option B.

So simply speaking, to make your measure work(show no access icon, actually they have access but no data), you'll have to assign proper roles for all users that would visit the report.