Dynamic RLS - Works in Desktop but not in Service

[tod]

I need help with implementing RLS. Sorry this is yet another RLS problem.

I created a test model in Desktop using 2 tables. First, called Security, contains 2 columns: UserID (to enter email) and Cost Center Name. Second table (Values) contains 2 columns: Cost Center Name and Values of each cost center. The 2 tables are joined with Cost Center Name via 1:1 (defaulted by Power Bi and the only option). No option to apply Security settings.

Then I created a security role, where I filtered UserID = Userprincipalname(). Tested using View As and works correctly. 

Exported to PBI premium service then under Security of the dataset, added the same email address of the viewers. These viewers don't have access to the Workspace itself. Under the dataset, they have Read only access. I tested the role in PBI service, and with the defaul the visual is blank, which is correct, because I didn't give myself a role. But when I enter the email address of the security members, the table shows the unfiltered values of all cost centers. 

Why does it not work in PBI Service? What am I missing? Thanks and appreciate all help. 

[Anonymous]

Hi @tod ,

You could refer to Row-level security (RLS) with Power BI. There are limitations and known issues of RLS.

Best Regards,

Stephen Tao

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[tod · Accepted solution]

It turns out that the "test as role" functionality in the service is buggy and inacurrate. I ended up taking a chance and releasing the reports to my community despite what "test as role" was showing as my last resort. And RLS worked, meaning the "test as role" view was wrong and misleading. Is there a way to submit a bug report? 

Thanks again for your posts and guidance.

[tod]

Thank you for directing me to check in the build permission. None of my 4 test users have any permissions given at all, yet 2 of the test users can still see all data (no RLS filter applied), and 2 works as per RLS rules. 

I test this under the "security" selection, above "Manage Permission".

I checked to make sure the remaining 2 users were not members of the premium workspace and their names are not listed at all. 

Kinda stuck to search where else could their permission profile be overridding my dashboard that has RLS filter. 

For additional context, the premium workspace has over 50 existing dashboards, none of them have RLS, and all 4 test users have view access to several of the existing non-RLS dashboards.

[Anonymous]

Hi @tod ,

You can check the permissions of the dataset from 'Manage permission'.

For more information, please kindly refer to Build permission for shared datasets.

Best Regards,

Stephen Tao

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[tod]

For some reason this is the 3rd time I'm replying to this so hopefully third time is the charm.

Thanks Stephen for the response.

> Data source is manually created in Enter Data in PBI for testing and the role setup is verified in Power BI.

> You are right. I published the report in another premium workspace that I know the 4 test users have no affiliation with the workspace and it works.

> So I went back to the original premium workspace and reviewed all the access rights. After either removing or changing to View or Read only, 2 of the 4 users still does have the RLS working so I'm stumped. Is there a "checklist" or list of where are the places we should look to review access rights setup?

Thanks again for your help.

[Anonymous]

Hi @tod ,

What is your data source? The main reason why RLS does not work is that the person viewing the report has editing rights to the dataset. Please double check whether your viewer is a member of the workspace, or whether he has editing rights to the report.

If possible, you can upload the report to another new workspace for testing.

Best Regards,

Stephen Tao

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.