Changing Role for Row-Level Security

[DataFun]

I have a dashboard where I have implemented row-level security.  On the desktop side I defined 4 roles as follows:

AME where the region = AME

APJ where the region = APJ

EMEA where the region = EMEA

Global where there is no filter set.

In the Power BI Service, in the designated workspace, I set the Security assignments.  There was 1 individual for AME and APJ, 3 for EMEA, and 4 Global. 

This has been working fine, but now we have some staff changes and I have removed two users and changed one user from EMEA to Global.  I have verified the setting and this individual is listed under the Global role, however, her access is still limited to EMEA only.  What else do I need to do to resolve this?

[v-ssriganesh]

Hi @DataFun,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.

[v-ssriganesh]

Hi @DataFun,

May I ask if you have resolved this issue? If so, please mark it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[rohit1991]

Hi @DataFun

If a user is still seeing EMEA data after you moved them to Global, a few things to check:

• Make sure they’re not still part of an Azure AD group that’s tied to the EMEA role.

• In the Global role, set the filter to TRUE() so it really gives full access.

• Test the role in Desktop using View As Role, then republish the dataset.

• Ask the user to refresh their session (clear cache/incognito) changes can take 15–30 mins to fully apply.

• Try another user in the Global role to confirm if it’s user-specific.

These usually fix RLS role change issues.

[DataFun]

I will try that, but why would this be necessary.  I removed the other role and added the new role.  Shouldn't it process the RLS based upon the assigned role?

[v-ssriganesh · Accepted solution]

Hi @DataFun,
Thank you for reaching out to the Microsoft Fabric Forum Community.

You're right Power BI’s RLS should reflect the assigned Global role, which should show all data if unfiltered. The TRUE() suggestion for the Global role ensures all data access but isn’t needed if the role is already unfiltered. If the user still sees only EMEA data, try these steps:

• In Power BI Service, confirm the user is only in the Global role, not EMEA, and check for conflicting Azure AD group memberships.
• In Power BI Desktop, verify the Global role has no filters and test with View As, and republish the dataset.
• Ask the user to clear their browser cache or use an incognito window, as permission changes may take 15–30 minutes to propagate.
• Ensure no dynamic RLS (e.g:  USERPRINCIPALNAME()) or report-level filters restrict data to EMEA.
• Test with another user in the Global role to isolate the issue and manually refresh the dataset in Power BI Service and retest.

If this information is helpful, please “Accept as solution” and give a "kudos" to assist other community members in resolving similar issues more efficiently.
Thank you.

[v-ssriganesh]

Hi @DataFun,
I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please accept it as a solution and give it a 'Kudos' so other community members with similar problems can find a solution faster.
Thank you.

[DataFun]

Rohit, Thank you for a detailed and thoughtful response.  I apreciate it.  I will try this and see if it works.

[Deku]

For the global role set a RLS expression on the country column as true(). This will overwrite the false from the other role