Forum Discussion
Row Level Security not working
Hello,
I've created a report and, in Desktop, I've created several roles relating to the different groups within the report and an "Exec" role to give Executives a view of all. I've filtered these roles using DAX and when I 'View As', I see exactly what I've intended for each role.
Next, I've gone into BI Service and added the directors to their respective group roles. I've also edited the app workspace to ensure that members can only view, not edit, BI content. I've then chosen "Test as role" and again see exactly what the role is intended to see.
Unfortunately, when I have a group director access the app they're able to see all data instead of being limited to just their group. Is there something I'm missing?
*Note - those with access to the app are not members of the workspace. I don't think they need to be, but figured I'd toss this info out there as well.
PBIUSER3 Yes, I ended up using Dynamic RLS to fix the problem. Our PBI login matches ID's in the data, for example:
Login: [email protected]
Data: UserID- UserBob123; Customer-ABEX; Order#-7524
I then used a filter in the role like: UserPrincipalName()=Concatenate(UserID,"@microsoft.com")
Hope that helps!
8 Replies
Hi jhartranft60,
According to document, it mentioned RLS not works for user who is the dataset owner or has edit permission.
Please double check his according to confirm if he has edit permission.Row-level security (RLS) with Power BI
Regards,
Xiaoxin Sheng
He does not. He's not a member of the workspace and only accessing the report via the app.
HI jhartranft60,
Can you confirm your table has correspond records with that user?
>>He's not a member of the workspace and only accessing the report via the app.
Did you mean external guest from external tenant and use Azure B2B feature to get access permission?
Distribute Power BI content to external guest users with Azure AD B2B
Regards,
Xiaoxin Sheng
PBIUSER3 Yes, I ended up using Dynamic RLS to fix the problem. Our PBI login matches ID's in the data, for example:
Login: [email protected]
Data: UserID- UserBob123; Customer-ABEX; Order#-7524
I then used a filter in the role like: UserPrincipalName()=Concatenate(UserID,"@microsoft.com")
Hope that helps!
