Dataset Credentials Issue - Power BI Service

[ARK-86]

Hi,

We have set up Azure SQL Database and building reports using Power BI.

On Azure SQL Database, we have enabled dynamic masking. We have created two database users, one (USER_MASK) that can only see masked data and another (USER_UNMASK) that can see unmasked data.

On Power BI, we have created two datasets, DS_MASK and DS_UNMASK. I have created a workspace (WS_MASK) containing dataset DS_MASK. In Power BI Desktop, I made sure that, in 'Data Source Settings', database user (USER_MASK) is set and published a report containing masked column to workspace WS_MASK. I then added a Power BI user as member to this workspace.

The issue is that when I run the report from Power BI admin user, it shows masked data as expected. But when that user runs the same report, he sees unmasked data. Why is that? Why dataset credentials are not being used when the user is running the same report?

I tracked Azure SQL Database query sessions as well. When I run the report from Power BI admin user, the query received from Power BI is using USER_MASK. But when Power BI user runs the same report, the query received is using USER_UNMASK.

Why and how is the user bypassing dataset credentials on which the report is built upon?

Really appreciate your support on this.

[v-luwang-msft]

Hi @ARK-86 ，

You could refer the following article, it tells how to achieve Dynamic data masking in Power BI using Analysis Services and SQL Server：

https://www.linkedin.com/pulse/dynamic-data-masking-power-bi-using-analysis-services-anthony-bulk 

https://www.sqlshack.com/implementing-dynamic-data-masking-in-azure-sql-database/ 

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Best Regards,
Lucien