Apply RLS filtering to Subscription via AD Group

[jcampbell474]

We have an app w/RLS defined using AD Groups.  Access is fine and works as expected.

We want to create a subscription for each user to get their data emailed to them, daily.  The issue is that there are ~1,200 users.  We thought we could use the AD Group in the sub and RLS would be applied, but it is not.  We tested with a handful of users and they get everything.  

Are we missing something or is it working as it should?

Hoping someone can help!

Thanks,
Jason

[Icey]

Hi @jcampbell474 ,

---

We tested with a handful of users and they get everything.  

---

This is by design. 

For paginated and Power BI report email subscriptions, if the dataset uses row-level security (RLS), you can create subscriptions for yourself and others. Those subscriptions will run using your security context. In other words, if you are the dataset owner, they will get everything in the subscriptions.

Therefore, users with different roles need to subscribe themselves to the report.

Reference: Considerations for subscribing others

Best Regards,

Icey

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[jcampbell474]

Thank you!  It does help and supports other sources I've found.  At the same time, I've seen this, too:

Solved: Re: Subscription and Row Level Security - Microsoft Power BI Community

The question is asked,
"Also, we have implemented Row Level Security in the dashboard so if an admin does the subscription process does the RLS flow properly?"

An msft employee replies, "Even if it is a dashboard that the administrator subscribes for others, RLS still takes effect.  

In fact, for members of a workspace with Admin / Member / Contributor roles, RLS does not take effect, regardless of how it is shared."

Feels like conflicting answers.  Am I looking at it the right way?

[Icey · Accepted solution]

Hi @jcampbell474 ,

Based on my test, currently, when you create subscriptions for others both on reports and dashboards with RLS, those subscriptions will run using your security context. 

These rules may have changed now. Please refer to the current situation. Thank you for your understanding.😉

Best Regards,

Icey

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.