Forum Discussion

jcampbell474's avatar
jcampbell474
Helper IV
5 years ago
Solved

Apply RLS filtering to Subscription via AD Group

We have an app w/RLS defined using AD Groups.  Access is fine and works as expected.   We want to create a subscription for each user to get their data emailed to them, daily.  The issue is that th...
AD group
RLS
RLS GROUPS
  • Icey's avatar
    Icey
    5 years ago

    Hi jcampbell474 ,

     

    Based on my test, currently, when you create subscriptions for others both on reports and dashboards with RLS, those subscriptions will run using your security context. 

     

     

    These rules may have changed now. Please refer to the current situation. Thank you for your understanding.😉

     

     

    Best Regards,

    Icey

     

    If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Icey's avatar
Icey
Community Support
5 years ago

Hi jcampbell474 ,

 

 

We tested with a handful of users and they get everything.  

 

This is by design. 

 

For paginated and Power BI report email subscriptions, if the dataset uses row-level security (RLS), you can create subscriptions for yourself and others. Those subscriptions will run using your security context. In other words, if you are the dataset owner, they will get everything in the subscriptions.

 

Therefore, users with different roles need to subscribe themselves to the report.

 

Reference: Considerations for subscribing others

 

 

Best Regards,

Icey

 

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

jcampbell474's avatar
jcampbell474
Helper IV
5 years ago

Thank you!  It does help and supports other sources I've found.  At the same time, I've seen this, too:

Solved: Re: Subscription and Row Level Security - Microsoft Power BI Community

The question is asked,
"Also, we have implemented Row Level Security in the dashboard so if an admin does the subscription process does the RLS flow properly?"

 

An msft employee replies, "Even if it is a dashboard that the administrator subscribes for others, RLS still takes effect.  

In fact, for members of a workspace with Admin / Member / Contributor roles, RLS does not take effect, regardless of how it is shared."

 

Feels like conflicting answers.  Am I looking at it the right way?

  • Icey's avatar
    Icey
    Community Support
    5 years ago

    Hi jcampbell474 ,

     

    Based on my test, currently, when you create subscriptions for others both on reports and dashboards with RLS, those subscriptions will run using your security context. 

     

     

    These rules may have changed now. Please refer to the current situation. Thank you for your understanding.😉

     

     

    Best Regards,

    Icey

     

    If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.