Forum Discussion
rls - users not assigned to roles
Hi - I just need to confirm something that i am unable to confirm explicitly from an documentation i've read
If I add one RLS role to my report and publish, what is the behaviour for a user who is not assigned to a role?
From my testing, I believe it is:
- user is member of the powerbi workspace - see everything
- user is listed in a role - see tables where role rules allow
- user is not listed in a role - can't see data in any tables
So... if I only added one role to the report - with a filter on 1 table as simply: 1 = 1
- anyone not listed in the role cannot see any data (unless they are a member of the workspace)
- i.e. if you add one role, every user has to be assigned a role
Is that correct?
Anyone have the right bit of documentation where i can see this?
Hi,
I just discovered it and I think it would answer the question.
If a user is not listed in any of the roles, even if he/she has access, cannot access the data.
learned the hard way :)
cheers
sunrit
5 Replies
- v-lili6-msft
Community Support
hi, willharris24
RLS is used to restrict access to row data.
You can use it in combination with USERNAME or USERPRINCIPALNAME.
Reference:https://powerbi.microsoft.com/en-us/blog/using-username-in-dax-with-row-level-security/
for example:
If I don't want "v-lili6" this to a row of data or an entire table.
then set rls like this:
then if "v-lili6" open the report
before use RLS
After use RLS
If you want to add a new account that do not have access to the row data, you just modified formula in the Manage Role
Now, "v-lili6"and "v-frank" all do not access to data in table4
Note:
If you have configured the app workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data.
Secure individual rows of data but users can always see either the details or the summarized data
Reference:https://docs.microsoft.com/en-us/power-bi/desktop-rls
https://docs.microsoft.com/en-us/power-bi/service-admin-rls
Best Regards,
Lin
- willharris24
Advocate I
thanks for the response, but it isn't answering the question.
I wanted to confirm that adding any role to a report prevents visibility of the data for all users who are not assigned to one of the roles (except for members of a workspace who have edit access).
I can now see that this is the case, but this is not referenced in the documentation
- sunrit
Advocate I
Hi,
I just discovered it and I think it would answer the question.
If a user is not listed in any of the roles, even if he/she has access, cannot access the data.
learned the hard way :)
cheers
sunrit