Forum Discussion

NorahTran97's avatar
NorahTran97
Frequent Visitor
10 months ago
Solved

set up RLS for a security group in Power BI

Hi all, I have the following setup in Power BI:    I created an RLS role called external_access. Inside the role, I use a DAX filter to control access by email, for example: email1 → can o...
Need Help
  • v-tejrama's avatar
    v-tejrama
    9 months ago

    Hi NorahTran97 ,

    Thank you for your follow-up question. It’s great to hear that RLS is working for internal users. Regarding your issue with external users, there are a few considerations to ensure RLS functions correctly when sharing with Azure AD B2B (guest) users. Firstly, confirm that the external users are properly added as guest users in your Azure AD tenant. They should have accepted the invitation and be assigned the appropriate roles within your organization. Additionally, ensure that the external users have the necessary Power BI licensing. If your organization is using Power BI Pro, external users also need a Pro license to access shared content. Alternatively, if your organization has Power BI Premium capacity, external users can access shared content without a Pro license, provided they are assigned to the appropriate workspace roles.

    Another important aspect is the workspace settings. For RLS to function correctly, the workspace should be configured such that members have Viewer permissions rather than Member or higher roles. This setting ensures that RLS filters are applied to users accessing the content. You can adjust this by navigating to the workspace settings in the Power BI Service and modifying the permissions accordingly.

    If the issue persists, consider testing the RLS configuration by sharing the report directly with an external user and verifying if the data visibility aligns with the RLS rules. This can help identify whether the problem lies with the RLS setup or the group-based sharing configuration.

     

    Please refer these Microsoft Doc links :

    Row-level security (RLS) with Power BI

    Securely sharing Power BI reports with external users


    Thank you.
     
nandic's avatar
nandic
Resident Rockstar
9 months ago

Hi NorahTran97 ,

RLS will always be dynamic.
If you use userprincipalname() dax function in rls logic, it always checks currently logged in user.
So if there are 10 users in same Azure user group and by best practice, we grant dataset/app permissions to user group, each user will see only what is allowed by rls for each user.
By using groups, we just make it easier for us to give all users access.

Note: for external users, regular external users having company mail, in rls table keep their actual mail.
Because this is how Power BI Service will recognize them.
Example: [email protected]

However, if external users use private emails (gmail, yahoo..), then in rls table you need to have prefix which Power BI Service adds.
Example: live#[email protected]

In addtion, Azure user group should be "Security" type so that it can be used on Power BI Service.

Cheers,
Nemanja