Row-level Security to Multiple Reports with Same Dataset

[ldmass]

Hi experts,
There are two reports on the same dataset, I wish to apply RLS differently on these two reports. Challenge is, since they are on same dataset, Power BI only lets me apply security at a dataset level. In one report a user X can see all the information, and the same user X in the other report can only see one zone. (we are PRO license)

I was looking at some post but none give a clear solution.

Does anyone have any workarounds?

Greetings & regards

[v-kkf-msft]

Hi @ldmass ,

A workaround is to create RLS and then place the two reports in different workspaces (A and B).

Then add the user X as an Admin/Member/Contributor of workspace A so that he can see all the data of the report in workspace A.

Then share the report in workspace B (without editing rights to the report) so that this user will only be able to see the RLS restricted content.

Best Regards,
Winniz

[ldmass · Accepted solution]

Thank you all!! Although this solution could work, it is not feasible due to the creation of workareas... Finally, I am going to create copies of the reports filtered to each zone (there are 4 zone values, therefore 4 copies of the report), and will be given access as appropriate

[bcdobbs]

I think you might be able to do something along these lines:

https://dobbsondata.co.uk/2022/03/08/calculation-groups-and-rls/

[TomMartens]

Hey @bcdobbs ,

this approach requires that users do not have build permission on the underlying dataset.

Regards,

Tom

[bcdobbs]

No I'm sure the RLS kicks in on the disconnected table even with build permissions as long as user not higher than a viewer in workspace with build permissions directly granted to dataset.

If the user were to build their own report they could choose whether to turn the calc group on or off and filter the rest of the report but the RLS is still active.

[TomMartens]

Hey Ben,

sure RLS will kick in, but with build permission on the dataset, a user can create his own reports using PBI Desktop creating his own measures without the need for using the disconnected table and the calculation group.

From my point of view RLS should always prevent users from seeing what they should not.

Tom

[bcdobbs]

Ok see what you mean. My reading of the question was that there was a need to use RLS to change user interaction rather than using it for security specifically.

[bcdobbs]

You could also do something along these lines:

https://www.sqlbi.com/articles/implement-non-visual-totals-with-power-bi-security-roles/

[TomMartens]

Hey @ldmass ,

this is not possible. The reason for this is simple, RLS will not be affected by the report, the dashboard, or even the tool that is retrieving data from the Power BI dataset.

Regards,

Tom