Forum Discussion

willharris24's avatar
willharris24
Icon for Advocate I rankAdvocate I
8 years ago
Solved

rls - users not assigned to roles

 Hi - I just need to confirm something that i am unable to confirm explicitly from an documentation i've read

 

If I add one RLS role to my report and publish, what is the behaviour for a user who is not assigned to a role?

 

From my testing, I believe it is:

  • user is member of the powerbi workspace - see everything
  • user is listed in a role - see tables where role rules allow
  • user is not listed in a role - can't see data in any tables

 

So... if I only added one role to the report - with a filter on 1 table as   simply:    1 = 1

  • anyone not listed in the role cannot see any data (unless they are a member of the workspace)
  • i.e. if you add one role, every user has to be assigned a role

 

Is that correct?

 Anyone have the right bit of documentation where i can see this?  

  • sunrit's avatar
    sunrit
    7 years ago

    Hi,

    I just discovered it and I think it would answer the question.

    If a user is not listed in any of the roles, even if he/she has access, cannot access the data.

    learned the hard way :)

    cheers

    sunrit

     

5 Replies

  • v-lili6-msft's avatar
    v-lili6-msft
    Icon for Community Support rankCommunity Support

    hi, willharris24

         RLS is used to restrict access to row data.

    You can use it in combination with USERNAME or USERPRINCIPALNAME.

    Reference:https://powerbi.microsoft.com/en-us/blog/using-username-in-dax-with-row-level-security/

     

    for example:

    If I don't want "v-lili6" this to a row of data or an entire table.

    then set rls like this:

    then if "v-lili6" open the report

    before use RLS

    After use RLS

    If you want to add a new account that do not have access to the row data, you just modified formula in the Manage Role

    Now, "v-lili6"and "v-frank" all do not access to data in table4

     

    Note:

    If you have configured the app workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data.

    Secure individual rows of data but users can always see either the details or the summarized data

     

     

    Reference:https://docs.microsoft.com/en-us/power-bi/desktop-rls

    https://docs.microsoft.com/en-us/power-bi/service-admin-rls

     

    Best Regards,

    Lin

     

    • willharris24's avatar
      willharris24
      Icon for Advocate I rankAdvocate I

      thanks for the response, but it isn't answering the question.

       

      I wanted to confirm that adding any role to a report prevents visibility of the data for all users who are not assigned to one of the roles (except for members of a workspace who have edit access).   

       

      I can now see that this is the case, but this is not referenced in the documentation

       

      • sunrit's avatar
        sunrit
        Icon for Advocate I rankAdvocate I

        Hi,

        I just discovered it and I think it would answer the question.

        If a user is not listed in any of the roles, even if he/she has access, cannot access the data.

        learned the hard way :)

        cheers

        sunrit