rls - users not assigned to roles

[willharris24]

 Hi - I just need to confirm something that i am unable to confirm explicitly from an documentation i've read

If I add one RLS role to my report and publish, what is the behaviour for a user who is not assigned to a role?

From my testing, I believe it is:

• user is member of the powerbi workspace - see everything
• user is listed in a role - see tables where role rules allow
• user is not listed in a role - can't see data in any tables

So... if I only added one role to the report - with a filter on 1 table as   simply:    1 = 1

• anyone not listed in the role cannot see any data (unless they are a member of the workspace)
• i.e. if you add one role, every user has to be assigned a role

Is that correct?

 Anyone have the right bit of documentation where i can see this?  

[v-lili6-msft]

hi, @willharris24

     RLS is used to restrict access to row data.

You can use it in combination with USERNAME or USERPRINCIPALNAME.

Reference:https://powerbi.microsoft.com/en-us/blog/using-username-in-dax-with-row-level-security/

for example:

If I don't want "v-lili6" this to a row of data or an entire table.

then set rls like this:

then if "v-lili6" open the report

before use RLS

After use RLS

If you want to add a new account that do not have access to the row data, you just modified formula in the Manage Role

Now, "v-lili6"and "v-frank" all do not access to data in table4

Note:

If you have configured the app workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data.

Secure individual rows of data but users can always see either the details or the summarized data

Reference:https://docs.microsoft.com/en-us/power-bi/desktop-rls

https://docs.microsoft.com/en-us/power-bi/service-admin-rls

Best Regards,

Lin

[willharris24]

thanks for the response, but it isn't answering the question.

I wanted to confirm that adding any role to a report prevents visibility of the data for all users who are not assigned to one of the roles (except for members of a workspace who have edit access).   

I can now see that this is the case, but this is not referenced in the documentation

[sunrit · Accepted solution]

Hi,

I just discovered it and I think it would answer the question.

If a user is not listed in any of the roles, even if he/she has access, cannot access the data.

learned the hard way 🙂

cheers

sunrit

[Suneer]

To give full access to a specific users, go to Manage roles >  create a Role Eg. "Full Access Users" with DAX Expression True

[DamianDavies]

You just get this error