Forum Discussion
Dynamic RLS with AD Security Groups - best practices and app sharing?
Hi, Vegard1985
It’s my pleasure to answer for you.
According to your description, I think you have great ideas. If your reports needs to be distributed to users with different permissions to see different data, RLS can indeed be used, and it is inevitable.
In the recent update, it has been supported to connect powerbi dataset and other data sources at the same time.
LInk:Power BI December 2020 Feature Summary | Microsoft Power BI Blog | Microsoft Power BI
After setting up RLS, you can publish an app, add the "all employees" group you mentioned, and then they will see different content according to the permissions you set, and other users outside of RLS can access the report, but they can't see all the data.
Remember not to give the user build permission of the dataset or edit permission of the report, otherwise RLS won't work.
If it doesn’t solve your problem, please feel free to ask me.
Best Regards
Janey Guo
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
"you cannot explore live data and connect to another type of data source in the same file"
Not any more! yipee!
Anyway, here's my take:
- RLS is based on either assigning users and distribution lists to roles in the Power BI service or (at the lowest granularity level) on identifying the user via USERPRINCIPALNAME() and then doing the group/permission mapping based on a reference table. You will want to pick your approach based on your scenario but I would assume you go with the latter.
- RLS needs to flow in order to bite. That means the RLS rules need to come from a dimension table at the far outskirts of your star/snowflake, and they better only point one way. Having a bidirectional search setup wholly defeats the purpose of RLS
- Lastly, RLS is a lot of effort for not a lot of gain. It is highly appropriate for finance and sensitive data, but it is highly counterproductive for pretty much anything else. Only use it if you absolutely, positively must use it. In all other scenarios teach your users how to filter to their focus areas.
"Not any more!" - is this in preview or something? Or in December version - I have PBI desktop November version 😐
Thanks for your input! I agree that RLS shouldn't be used unnecessarily. I don't plan on doing this for anything else than sensitive data, we don't need RLS to help employees "filter" correctly. Our group partly consists of competing companies, so anything that shows margin is off the table for employees in daughter companies - strict ref Competition Authorities.
Do you have any tips on my question 3 though, about PBI Service/app distribution?