Forum Discussion
Share your thoughts on DirectQuery for Power BI datasets and Azure Analysis Services (preview)
Team,
In short when will some of the RLS contraints be relaxed, specifically the item in red text below from the documentation write up.
- RLS rules will be applied on the source on which they're defined, but won't be applied to any other datasets in the model. RLS defined in the report won't be applied to remote sources, and RLS set on remote sources won't be applied to other data sources. Also, you can't define RLS on a table from another source group nor can you define RLS on a local table that has a relationship to another source group.
Here's the design challenge where i'm trying to avoid maintaining 2 different copies of the same file.
I have a "Central Source" PowerBI Dataset that has master employee dataincluding sensitive comp information (fact table) which has RLS [Ops person for Departartment 1 only sees staff in Department 1] in place on a department reference table (dimension table) . I'm trying to build other reports off that power BI dataset that aren't sensitive or restricted so that all staff can see. Most design options I attempt fail due to RLS restrictions associated with the Direct Query on PowerBI Datasets preview feature.
- Design Option 1 [FAIL] - When I create a new report "All Staff Reports" and I direct query to the "Central Source" Power BI dataset the RLS upstream is imposed preventing people with read access to "Central Source" and my new "All Staff Reports" to seeing the data unless I want to add them to RLS to the master employee data restricting them, which I don't want to do.
- Design Option 2 [FAIL] - I decided to remove the Department reference table and RLS from the "Central Source" Power BI dataset and add it as a local table to the "All Staff Reports" imposing RLS. I created a relationship to the master empoyee data table in "Central Source" on Department reference table in "All Staff Reports" . The relationship works, the RLS works on the department table. However the RLS won't apply upstream to the master employee data table due to the red text highlight above from MS documentation.
- Design Option 3 [Fail] - create another Power BI Dataset just for the Department Reference data and in a new "All Staff Reports" dataset connect to "Central Source" and "Department Reference" datasets. Then create a relationship between the Master Employee Data in the "Central Source" and Department in "Department Reference". I then try to apply RLS on another power BI dataset that I have a direct query connect to but can NOT because that's part of the documented limitations 😞
At this point i've resolved to having to copy the file into two files and maintain the two but that defeats the purpose of what I think you all were going for tied to the preview feature. Posting here in the hopes you all are losening some of the RLS restrictions.
Thank you for taking the time to review!
- jeroenterheerdt3 years ago
Microsoft Employee
hi, thanks for the detailed feedback and explanation. Unfortunately we are not planning improvements in this area in the short term as this is a hard problem to solve. We simply don't have a good design yet for it that satisfies all requirements. That being said, thanks again for the feedback. This is very valuable input that helps us prioritize this.