RLS Not Applying When Added/Saved from Power BI Report Server, but Works After Re-uploading it

[Maverik91]

Hello, Power BI Community,

I am experiencing a critical issue with Row-Level Security (RLS) that seems to depend on the workflow used to apply it. When I configure RLS directly opening in edit mode from Power BI Reporting Service, the security rules do not take effect, even though they appear to be set up correctly.

The security rules only become active after the report is downloaded and then re-published from the Desktop application.

Has anyone else encountered this behavior? Is this a known issue, or am I missing a step when configuring RLS directly in the service?

Any help or insight would be greatly appreciated.

Thank you

[v-venuppu]

Hi @Maverik91 ,

May I ask if you have resolved this issue? Please let us know if you have any further issues, we are happy to help.

Thank you.

[v-venuppu]

Hi @Maverik91 ,

I wanted to check if you had the opportunity to review the information provided and resolve the issue..?Please let us know if you need any further assistance.We are happy to help.

Thank you.

[v-venuppu]

Hi @Maverik91 ,

Thank you for reaching out to Microsoft Fabric Community.

When you define Row-Level Security (RLS) directly in the Report Server (via browser), it may not apply correctly. Microsoft recommends defining RLS roles in Power BI Desktop using the “Manage Roles” feature.Then, publish the report from Desktop to Power BI Report Server. Avoid editing RLS roles directly in the Report Server UI, especially with DirectQuery models. This ensures the roles are embedded properly and enforced as expected.

Please find the below Microsoft documentation for your reference:

Row-level security (RLS) in Power BI Report Server - Power BI | Microsoft Learn

Thank you.

[Maverik91]

Hi @v-venuppu 

Thank you for your response and for the documentation.

I'd like to clarify the exact procedure I am following, as I believe it points to a specific bug rather than a deviation from best practices. The workflow you described (creating roles in Desktop and then publishing) is what we generally do. The issue arises during subsequent edits.

Here is my exact workflow:

1. I open the Power BI Report Server portal in the browser.
2. I navigate to an existing report and select the option to "Edit in Power BI Desktop". This action opens the report in the Desktop application directly from the server.
3. After making my changes in Power BI Desktop, I use the Save function, which saves the report directly back to the Report Server, overwriting the existing version. This is the integrated and recommended way to update reports.
4. Following the save, I go to the report's settings in the web portal (Manage > Row-level security) and assign users to the appropriate roles. The interface shows everything is configured correctly.

The Problem: When I follow this specific "edit from server and save back" process, the RLS rules are not enforced at all. Users can see all the data.

The Workaround/Proof of Bug: If I then take that exact same report (which isn't working), download the .pbix file to my local machine, and immediately upload it back to the server, overwriting the report, the RLS starts working perfectly without any other changes.

This behavior leads me to conclude that this is a bug. The server fails to correctly apply the RLS policies when a report is saved directly from Power BI Desktop via the "Edit from Server" feature. However, the manual upload process correctly triggers the security application.

I hope this clarification helps to better define the issue.

Best regards,

[v-venuppu · Accepted solution]

Hi @Maverik91 ,

You are absolutely right: the behavior you are seeing is consistent with a known limitation in Power BI Report Server. When you use the "Edit in Power BI Desktop" feature directly from the Report Server portal and then save back to the server, the RLS roles may not be properly embedded or refreshed in the report metadata - even though the UI shows them as configured.
To ensure RLS  works correctly on Power BI Report Server(Until the issue got fixed):

 Recommended Workaround is as follows:

Download the .pbix file manually from the Report Server.
Edit it in Power BI Desktop (not via “Edit in Power BI Desktop” from the portal).
Save locally, then upload manually back to the Report Server.

This manual upload correctly triggers RLS enforcement, unlike the “Edit from Server and Save” method, which may skip refreshing RLS bindings due to a known issue.

Thank you.