Forum Discussion
Can't figure out what's wrong with my RLS
Hello, maybe you might help me on this please:
- I create an empty report
- I create a simple measure = USERPRINCIPALNAME()
- I show the measure in a simple Card on a page with nothing else on it
- I create a RLS role with no rules in it (I'd like you to focus on the USERPRINCIPALNAME behaviour only for now)
- I test "View as" another user (internal in my Organization) by typing their UPN and the card correctly refreshes and shows that UPN (as expected)
- I publish the report
- On the Service under the Workspace roles I make sure that user is Viewer only so that RLS is actually applied, according to official documentation (I am the administrator)
- I make sure that user is added in the Semantic Model Security RLS users list
- Under Security again I test "As Role" and then "View as" that user
- The card refreshes but still shows my USERPRINCIPALNAME(). And it's funny because on top of my screen I see "Viewing as (that person)" while the card shows myself. It looks like Service is just ignoring its own "View as" feature
- I also tried to remove the user from the Workspace and re-added him all over from scratch, no change
What I am missing?
Your model is fine. This is a known quirk of Test as role in the Service.
USERPRINCIPALNAME() is not overridden by View as in the Service when the person running the test is Admin, Member or Contributor on the workspace. RLS doesn't apply to those roles, and neither does the identity spoofing, so the function keeps returning your own UPN even though the banner says Viewing as someone else. Desktop works because View as there hard overrides the function regardless of your role.
To actually test it, log in with a second account that is only a Viewer (or not in the workspace at all but assigned to the role) and open the report directly. Test as role in the Service is fine for checking filter logic, but not for anything that depends on the user identity when the tester is privileged.
If this was helpful please thump up and mark as resolved.
Thanks 😊
5 Replies
Your model is fine. This is a known quirk of Test as role in the Service.
USERPRINCIPALNAME() is not overridden by View as in the Service when the person running the test is Admin, Member or Contributor on the workspace. RLS doesn't apply to those roles, and neither does the identity spoofing, so the function keeps returning your own UPN even though the banner says Viewing as someone else. Desktop works because View as there hard overrides the function regardless of your role.
To actually test it, log in with a second account that is only a Viewer (or not in the workspace at all but assigned to the role) and open the report directly. Test as role in the Service is fine for checking filter logic, but not for anything that depends on the user identity when the tester is privileged.
If this was helpful please thump up and mark as resolved.
Thanks 😊
Hi, thank you, so basically if I am an Administrator I just can't doublecheck in the Service what other users would see with their reports, is that correct?
Hi Uchenzei,
Thanks for reaching out to the Microsoft Fabric Community forum.Yes, that’s correct for functions like USERPRINCIPALNAME(). If you’re an Administrator (or Member/Contributor), RLS isn’t enforced for your role in the Service, and the “View as” option doesn’t actually override your identity. That’s why even though it shows “Viewing as” another user, the report still returns your own UPN.
To really see what another user experiences, you’ll need to test with a separate account that has only Viewer access (or isn’t part of the workspace), or have the end user confirm it directly. The “View as” feature in the Service is still useful for checking RLS filters, but it’s not reliable for anything that depends on the actual user identity.
For more details, please go through official documentations:
Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn
USERPRINCIPALNAME function (DAX) - DAX | Microsoft Learn
I hope this information helps. Please do let us know if you have any further queries.
Thank you
