Row Level Security into PowerBI Service Issue

[S19K15]

When using PowerBI Service with a relational datasource we can assign roles into the report providing the filter rules and the assigned users. In the search list of the users, users are retrieved from the Active directory where normal organization users exists but also external guest users if any invited already to organization Active Directory.

Then if an organization user assign a guest user into workspace access, the guest user can see the workspace under the "From External Org" tab in his PowerBI Service but the RLS is not working and I sussect that something has to do with the user formatted identity, as guest users are having the #EXT#organization flag into their identity and therefore might be a bug.

In addition, there is no way to specify users which are not exist into Azure Active Directory to cover PowerBI Embedded schenario, at this moment though PowerBI Embedded API we can specify only the role name we want to apply but this sometimes depending on the business this is something that the customer want to change into report level and not the developer though the Embedded application have it hardcoded or being changed programamtically.

[v-xiaoyan-msft]

Hi  @S19K15 ,

Row-Level Security (RLS) not working for guest users in PowerBI Service is related to the format of the User Principal Name (UPN) for external users.

Solved: RLS for External guest users - Microsoft Fabric Community
As for assigning roles to users not in Azure Active Directory for PowerBI Embedded,Currently PowerBI Embedded API allows you to specify only the role name to apply.

For more you may refer to :Power BI REST APIs semantic model permissions - Power BI | Microsoft Learn

Best regards.
Community Support Team_Caitlyn