Can I limit workspace member, workspace admin to see some sensitive information in a report?

[Anonymous]

Hello!

I have a shared dataset in workspace A, and all reports published in workspace B.

Now I have some workspace admins, workspaces members, workspace viewers for workspace B but these people are just having read and/or build permission on the dataset in workspace A. So these persons can see all the reports in Workspace B. However I don't want some persons to read sensitive information in certain reports like salary, employment type... I set RLS in desktop and also set security of the dataset in workspace A.Could these workspace admins, members, contributors for workspace B can read the salary information or not?

[Tutu_in_YYC · Accepted solution]

If you want them to see all data, you dont need to set RLS for them. Just set them as Viewer role in the workspace and do not set RLS on the dataset.

If the dataset requires RLS for other users, then you need to create within RLS another role that doesnt contain any filter.

[Anonymous]

Thank you! But these people are not workspace administrator, member and contributor in the dataset workspace. They are just workspace administrator, member and contributor in the reports workspace. I tested it today. When I put some people to the role who can not see sensitive information, it works as those people can not see. However for the others they are not in this role, they should be able to see the whole report but it showed they can not see the report at all because underlying dataset using RLS. I don't understand why this happened. 

[v-yueyunzh-msft]

Hi , @Anonymous 

When you create RLS in your dataset , You must configure the corresponding role in the "Security" of the Dataset in order for the corresponding person to access the report.
For members that you do not have configuration permissions for and are still in the B workspace, those members also do not have edit permissions relative to the dataset and cannot access the report.

If you want certain members to see all the data, you need to add these members to one of the admin, member, contributor roles in workspace A.

Best Regards,

Aniya Zhang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly

[Anonymous]

Hi,
Thank you very much for your guideance. Just to make sure that "For members that you do not have configuration permissions for and are still in the B workspace, those members also do not have edit permissions relative to the dataset and cannot access the report." Yes, they don't have edit permission for the dataset. So for these members, should I also add them to a role? Because they need to see all the data, should I set a RLS role for them and if so, actually there is no any filter in this RLS.  

Thank you and look forward to your reply. 

[v-yueyunzh-msft · Accepted solution]

Hi , @Anonymous 

"For members that you do not have configuration permissions for and are still in the B workspace",for these members，Here are the suggestion you can try:

(1)If you want to they see the all data to the dataset , you can add them to the Workspace A (Admin/Member/Contributor) to give them the edit permission of the dataset.

(2)You can also configure the roles in "Security" of the dataset  to these members , then they can then take effect based on the RLS you configure . 

Above all the two , if you don't configure the RLS in "Security" of the dataset and also don't give them the edit permission of the dataset , they will not have permission to the report which create on the dataset .

Best Regards,

Aniya Zhang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly

[Tutu_in_YYC · Accepted solution]

If you want them to see all data, you dont need to set RLS for them. Just set them as Viewer role in the workspace and do not set RLS on the dataset.

If the dataset requires RLS for other users, then you need to create within RLS another role that doesnt contain any filter.

[v-yueyunzh-msft]

Hi , @Anonymous 

You have set RLS for the dataset and configured the corresponding security.

For workspace members, Admin, Member, and Contributor will not take effect for RLS, and they will still see all the data for that dataset.

Only the Viewer role for workspaces takes effect for RLS.

For more information, you can refer to :
Row-level security (RLS) with Power BI - Power BI | Microsoft Learn

Best Regards,

Aniya Zhang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly