Dynamic RLS and Apps Permissions List

[JRA21_13_19_25]

Hello,

I want to use a security table to create dynamic RLS using USERPRINCIPALNAME() so that employees can only view data for their region.

If an employee is the security table but they are labelled under a region that is not in my report, will they be able to view all the data in the report if I still add their email address to the permissions list in my App?

Many Thanks,

[Vera_Carey · Accepted solution]

RLS utilizes filters to restrict data access (usually based on roles). If your filter result returns no rows, as would be when an employee is labeled under a region that is not in your data, that employee will see exactly that - nothing.

Here is a quick theoretical example. Let’s say your filter DAX look like this:

     [SalesRegion]=”Value”

If your employee in question is assigned to “Europe” the RLS filter will return the following result:

     SalesRegion=”Europe”

…and if “Europe” is not in your underlaying data, then that filter will return no rows (and that is exactly what this employee will see (no rows/nothing).

Quick note - You can check if your role/RLS is acting as expected in Power BI Service. To do that, in Power BI Service, select More options (...) next to the role and then select Test data as role 

Important point to remember: If you have configured the workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data regardless of your RLS settings. So doubl-check that configuration if your RLS is not working as expected.

The above is a general answer. To enable a more focused answer please provide more detail (your DAX filter, your security table, etc.)

Cheers,

Vera

[GilbertQ]

Hi @JRA21_13_19_25 

If the user is not in the RLS table, they will not be able to view any data because there is no row which will allow them to see anything.