Security RLS and Right Create report for advanced users

[Cobra77]

Hi

We have a dataset for the group ( with for exemple 5 divisions ) .

we have put in place the RLS.

RLS its ok for users.

But in each divisions we have an advanced user who want create their reports.

if I put them viewer, it does not see the dataset from power bi desktop

And and if I put them contributor, they see the data of all the divisions.

How do ? I forgot something ?

Thanks for your help.

[Anonymous · Accepted solution]

Hi  @Cobra77 

You can use dynamic RLS to achieve your needs ,but this should be distinguished according to the type of workspaces.

(1)If you publish your Power BI Desktop report to a new workspace experience in the Power BI service, the RLS roles are applied to members who are assigned to the Viewer role in the workspace. Even if Viewers are given Build permissions to the dataset, RLS still applies.

In this case, users with editing rights can select the dataset that has been shared when creating the report . They can only see the data belonging to their department .

(2) If you have configured a classic workspace so that members have edit permissions, the RLS roles won't be applied to them. Users can see all of the data. Because the Member with edit permissions in classic workspace is the same with Member in new workspace . In new workspace ,the role for Member can see all the data from dataset .

So you need to be able to distinguish the role of different roles in different workspaces .

More info about roles in workspace can refer to the link :

https://docs.microsoft.com/en-us/power-bi/collaborate-share/service-new-workspaces#roles-in-the-new-...

Best Regards

Community Support Team _ Ailsa Tao

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous · Accepted solution]

Hi  @Cobra77 

You can use dynamic RLS to achieve your needs ,but this should be distinguished according to the type of workspaces.

(1)If you publish your Power BI Desktop report to a new workspace experience in the Power BI service, the RLS roles are applied to members who are assigned to the Viewer role in the workspace. Even if Viewers are given Build permissions to the dataset, RLS still applies.

In this case, users with editing rights can select the dataset that has been shared when creating the report . They can only see the data belonging to their department .

(2) If you have configured a classic workspace so that members have edit permissions, the RLS roles won't be applied to them. Users can see all of the data. Because the Member with edit permissions in classic workspace is the same with Member in new workspace . In new workspace ,the role for Member can see all the data from dataset .

So you need to be able to distinguish the role of different roles in different workspaces .

More info about roles in workspace can refer to the link :

https://docs.microsoft.com/en-us/power-bi/collaborate-share/service-new-workspaces#roles-in-the-new-...

Best Regards

Community Support Team _ Ailsa Tao

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Cobra77 · Accepted solution]

Hi @Anonymous 

I removed the viewer rights on the workspace and put the reader and build rights on the dataset and it looks good.

Thanks

[parry2k]

Once you have permission on the dataset then no RLS Is applied, use get to see everything.

Check my latest blog post Comparing Selected Client With Other Top N Clients | PeryTUS  I would ❤ Kudos if my solution helped. 👉 If you can spend time posting the question, you can also make efforts to give Kudos to whoever helped to solve your problem. It is a token of appreciation!

⚡Visit us at https://perytus.com, your one-stop-shop for Power BI-related projects/training/consultancy.⚡

[Cobra77]

Hi @parry2k 

how to give them the right to create reports with the dataset, but with only their data by division?