Forum Discussion
App Security and Roles
Hi Nick,
According to my test and the documentation, the RLS role will be applied to read-only members (including the users who are the audience of publishing the App). If a user have access to an App workspace and have read-only view, the RLS role will work even the role isn't assigned yet. So the user won't see anything until a proper role is assigned to him. If you forget to assign a role to a user, he/she can't see anything if he/she is a read-only member.
Now you have several things to consider.
1. If the RLS is good enough to hide the report.
2. If the users can be read-only members.
Best Regards!
Dale
Astro Rather than add individual users to the report role, have the role use an AD security group (if possible) or a group container that has the users. In that regard, they would have to be part of the group to even see the report in the first place and your RLS is automatically applied.
Anonymous, Thank you very much for your response. I'm trying to digest how to apply that and I'm not quite clear on the approach. There is an O365 group which I assume must get created when the app is published and users have been granted access to it via the Power BI service. But that group membership would mean they see everything in the app. I'm not quite clear how I assign view access to a group to the entire app with the exception of one report.
Astro From the way I read your post it first sounded like you wanted permission based report elements. Example: This groups sees 4 reports, this group sees 3. - > This is not currently possible. The rest of your description made it sound like you figured that part out and were just going to apply RLS so that the other group just wouldn't see any data in report 4. My comments relates to the second.
With RLS, you can use a security group within the role. When you publish your App, you can publish to a security group. If the security group is the same, no one would have access to the app without also being a member of your security group and thus those users would always be filtered.