Direct Query and Row Level Security - Do Viewers need to have read access to SQL Server database?

Hi Anonymous ,

According to your description, you don't need to grant SQL Server database read permission to every Viewer, they will connect to the data source through the gateway using the credentials you configure. If configured correctly, each viewer will use the credentials you configure to connect to the data source and send filtered queries according to the Row Level Security rules you configure to get the data.

Special attention, if you have configured a classic workspace so that members have edit permissions, the RLS roles won't be applied to them. Users can see all of the data.
If you publish your Power BI Desktop report to a new workspace experience in the Power BI service, the RLS roles are applied to members who are assigned to the Viewer role in the workspace. Even if Viewers are given Build permissions to the dataset, RLS still applies. For example, if Viewers with Build permissions use Analyze in Excel, their view of the data will be protected by RLS. Workspace members assigned Admin, Member, or Contributor have edit permission for the dataset and, therefore, RLS doesn’t apply to them. If you want RLS to apply to people in a workspace, you can only assign them the Viewer role.

Here are some references that may be helpful.

Row-Level Security for Cloud models and DirectQuery in Power BI

Row-level security (RLS) with Power BI
Add or remove a gateway data source

Best Regards,
Community Support Team_Gao

If there is any post helps, then please consider Accept it as the solution to help the other members find it more quickly. If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

How to get your questions answered quickly -- How to provide sample data