Metric-level permissions not working?

[Andrea_W]

I hope I've not done something really stupid here.

I am trying to set up permissions for scorecards in Power BI Metrics.  I have followed the instructions, ticking the relevant "view" and "update" boxes, but when the users assigned to the permission go to view the scorecard, they are seeing ALL metrics, not just the ones ticked.

The users are not admins of the workspace or Power BI admins.  The default permission is to view none and update none.

I am stumped.

[Anonymous]

Hi @Andrea_W ,

The default permissions apply to anyone accessing the scorecard who is not a member of another role already. If someone is a member of another role, they assume those permissions over the default permissions.

Please check if you have met this limitation.

Protect your scorecards with metric-level permissions - Power BI | Microsoft Learn

Best regards.
Community Support Team_ Caitlyn

[Andrea_W]

@Anonymous   Thank you very much for taking the time to reply. 

The users were assigned to roles that limited the number of metrics they could see and update.  The issue was that they were still able to see and update all metrics, not just the ones ticked for their role.  The default was definitely not the problem - as stated, the default is to not be able to see or update any metrics.

On advice from Microsoft support, I took the users off their assigned roles, and added them back on again.  I also refreshed the scorecards and datasets.  It now seems to be working properly for all but one user - I suspect they have some admin privileges that I can't see (they are definitely not admins of the workspace, so it must be something else).  They are still able to see and edit all 44 metrics on the scorecard, even though their assigned role says they can see and update only 2.

[Andrea_W]

Just repeated the "taking off and putting back on again" method, and refreshed everything again, and it's now working for the person who it wasn't working for yesterday.  Looks like it takes a while for the permissions to kick in.  Anyway, problem solved  🙂