Row Level Security and Filters

[TrentS]

Good day all,

Have an interesting user experience happening that I need suggestions on.

We have RLS configured for Countries and Geographical regions. Multiple table filters set in RLS. This restricts the data seen to just that users region/country. Pretty standard.

One user (so far) has reported multiple instances where filters on multiple pages will list additional countries not within their area. (with Screenshots) No data is displayed and we have confirmed that these areas are not within the filters set in RLS.

If the page is refreshed, the options do not show up in the filters. 

It almost seems like RLS is "slow" in being applied. (These are large (250mb) reports on a premium node.)

Any ideas on where to go with this one?

Many thanks for your time and insights.

Trent

[v-xicai]

Hi @TrentS ,

The RLS will be applied to read-only members. If you have configured the app workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data.

For reference:

https://docs.microsoft.com/en-us/power-bi/service-admin-rls#using-rls-with-app-workspaces-in-power-b... ,

Best Regards,

Amy 

Community Support Team _ Amy

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[TrentS]

@parry2k, I agree! Very odd behavior. None of the slicers showing the additional countries have anything selected as default. The geography setting does not show anything additional to match the incorrect country either. (The person should see Latin America countries but not European however when France shows in the country list Europe does NOT show up in the Geo slicer.)

@Amy, Thanks Amy but the user is set to read only and does not actually see any of the data. The odd country selection only appears in the slicer.

Trent

[parry2k]

@TrentS how you are connected to data source, direct query or import? Are there selections in slicers for these countries? If yes then these will show up as slicer value and after unselect, it will disappear.

[TrentS]

Thanks for the reply, Parry.

The data set is an import. The odd countries showing up in the slicers are seemingly random and meet the criteria set in the RLS filters to be excluded from that users view. Again, no data is displayed when they are selected and they go away on a page refresh.

We have verified that our country dim table is set correctly matching country/regions. The other tables referenced in the RLS rules that may have their own country field (for various reasons) are also set correctly.

When I view that same Role, I do not see those countries in the slicers.

Trent

[parry2k]

@TrentS  very hard to tell what is going on? Do you have value previously selected in the slicer before you test another user for RLS?