Forum Discussion
RLS: how can I enforce RLS for report creators? Can I do RLS inside the data source?
- 5 years ago
Clarify what you mean by Report Creators. Also please specify which SKU you are on.
Notes:
RLS does not work in a workspace. Anyone with access to the workspace can see all the data. One of the many reasons to restrict access to workspaces as much as possible.
RLS works as expected in apps. It also works in reports created off the apps, and in the "Analyze in Excel" files that connect to the dataset.
- 5 years ago
OneWithQuestion
RLS is on the model, not a data source. But when you are setting up RLS, if you only set it up on some fields that are in some tables, then only those fields/tables will be affected.But if your users are report creators and using Power BI Desktop, they can see everything. That is where you set up the RLS conditions, then you set up the RLS Security in the service. So you cannot restrict data in Power BI Desktop unless it is restricted at your source - SQL Server or SSAS before the data gets to Power BI Desktop.
However, if you do that, then I am not certian how any additional RLS could be done. For example,
- Report Writer A has permissions to see Sales Regions A, B, and C, but not D, E and F.
- Report Viewer B has permissions to see region F
- How would Report Writer A be able to see and test to write RLS to limit region F to Viewer B if they cannot even see F?
Typically report writers see all data. I am not saying it cannot be done, but it really becomes more of a data management issue at the source, not within Power BI.
Is that your question?
- 5 years ago
Yes. Creating a report based on multiple datasets is coming but not sure when, and I wouldn't be surprised if additional features like RLS, Incremental Refresh, etc. wouldn't be available day one. Could be, but that is a lot to launch right out of the gate.
Clarify what you mean by Report Creators. Also please specify which SKU you are on.
Notes:
RLS does not work in a workspace. Anyone with access to the workspace can see all the data. One of the many reasons to restrict access to workspaces as much as possible.
RLS works as expected in apps. It also works in reports created off the apps, and in the "Analyze in Excel" files that connect to the dataset.