Row level security with different scenarios is not working together.

[POSPOS]

Hi All,

I have a requirement as below.

I have below tables.
User table with User ID
UserFund Table with User ID and Fund
MasterTable (more than 5 tables) with Fund and other fields.
(User table joined with UserFund based on user ID. UserFund joined with MasterTables based on Fund)

The report has 11 pages. There are two scnearios to handle.
Scenario 1 : Users should see only the data they have access to. For this I created a role - to check the user logged in and give access to only the data they have access to

Scenario 2 : Users should see only 8 pages and full data (no data restriction). For this I created a role to hide the remaining 3 pages and I am not checking for any data level access.
Here, I am able to control the pages users should see with page level security (I created a table with all pages and assigned navigate to each page using a button click)

These roles are created on UserTable. Both the  scenarios work fine individually.

Issue:  If a user is in both the roles, he should still see restricted data in the remaining three pages which is not part of second role. But, he is seeing full data.

Can someone please let me know how to fix this?

Note: We would like to achieve this with the same semantic model rather than creating two seperate semantic models as the data is quite huge and the refresh time is large. We want to avoid duplicating the refresh.

Thank you

[v-dineshya]

Hi @POSPOS ,

Thank you for reaching out to the Microsoft Community Forum.

Hi @FBergamaschi  and @Zanqueta , Thank you for your prompt responses.

Hi @POSPOS ,  could you please try the proposed solutions shared by  @FBergamaschi  and @Zanqueta  ? Let us know if you’re still facing the same issue we’ll be happy to assist you further.

Regards,

Dinesh

[v-dineshya]

Hi @POSPOS ,

We haven’t heard from you on the last response and was just checking back to see if you have a resolution yet. And, if you have any further query do let us know.

Regards,

Dinesh

[Zanqueta]

Hi @POSPOS 

The behaviour you are experiencing is expected because when a user belongs to multiple roles in Power BI, security is applied additively:

The user sees the combined permissions of all roles, not the intersection.

Therefore, if one of the roles does not apply any data restriction (Scenario 2), it overrides the logic of the first role, granting full access to the data.

Official reference:

Row-level security (RLS) guidance in Power BI Desktop - Power BI | Microsoft Learn

If this response was helpful in any way, I’d gladly accept a 👍much like the joy of seeing a DAX measure work first time without needing another FILTER.

Please mark it as the correct solution. It helps other community members find their way faster (and saves them from another endless loop 🌀.

[FBergamaschi · Accepted solution]

You need to create a single role combining the two scenarios

If a user belongs to multiple roles, he will see the union of what each role lets the user see. So if in one of the two you do not apply filters, that person will se everyting

So it does not work with separated roles in your case

If this helped, please consider giving kudos and mark as a solution

@me in replies or I'll lose your thread

Want to check your DAX skills? Answer my biweekly DAX challenges on the kubisco Linkedin page

Consider voting this Power BI idea

Francesco Bergamaschi

MBA, M.Eng, M.Econ, Professor of BI