How to automatically update a scorecard linked to a PowerBi dashboard with RLS

[mavn]

Hi everyone,

I'm facing an issue with scorecards in Power BI Service and would appreciate some guidance.

We have a scorecard connected to several dashboards and reports in the same workspace. These dashboards use Row-Level Security (RLS). 

The issue is:

- When our dataset refreshes and we go to the scorecard, the metric values (like Progress and Trend) do not update, even after clicking the refresh button at the top-right of the scorecard page. We have discovered this seems to be due to scorecards goals don't support RLS, which means it is not able to pull data from the dashboard the goal is connected to which has RLS. So even though I have access to all the data in the dashboard with RLS, it seems that the scorecard refresh engine is a different service account that runs entirely in the back end. As soon as a dataset contains at least one RLS role it’s flagged IsSecured = true. Because scorecards have no way to pass an effective-identity (role/user) when they call the dataset, the platform simply refuses to evaluate the query and the metric never updates.

The only ways we’ve been able to see updated values are by:
- Manually refreshing each metric, which is time-consuming (we have ~200 metrics).
- Or removing RLS from the reports that feed the metrics (which we don’t want to do for security reasons).

Has anyone experienced this? Is there a way to automatically refresh all metrics in a scorecard even when RLS is enabled?

We’re looking for a solution that:

- Doesn’t require removing RLS.
- Doesn’t involve clicking “refresh” on each metric manually.

Thank you!

[v-karpurapud]

Hi @mavn 

Thank you for posting your query in the Microsoft Fabric Community Forum, and thanks to @Ilgar_Zarbali and @anilelmastasi  for sharing valuable insights.

Could you please confirm if your query has been resolved by the provided solution? This will help other community members solve similar problems faster.

Thank you.

[Ilgar_Zarbali]

You're correct — Power BI scorecards currently do not support automatic refresh for goals linked to RLS-enabled datasets, because scorecards can't impersonate user identity when evaluating metrics.

Current Workarounds:

1. Use a Service Principal or Admin Role:
   

   * Create a separate dataset without RLS that mirrors the required metrics.

   * Populate it via DAX measures or Power Query using SUMMARIZE, GROUPBY, etc., and then link your scorecard to this "public" version.

2. Use Dataflow as a Middle Layer:
   

   * Offload data into a Power BI Dataflow with no RLS.

   * Feed your scorecard from this RLS-free layer. Your RLS-secured reports can still connect to the original secured model.

3. Scripted Refresh via Power Automate or REST API (Partial Help):
   

   *Use Power Automate to programmatically trigger a refresh of metrics.

   * However, it still won’t override RLS limitations, unless connected to non-RLS data.

Limitations

• Scorecards can't pass effective identity, so they can't query secured models (RLS = IsSecured = true).
• No current API or setting allows impersonating a specific user for goal evaluation.

Recommendations:

• Maintain RLS for your reports.
• Create a summary model or intermediate dataset without RLS solely for scorecard metrics.
• Sync it during refresh using scheduled flows or Power Query.

If this helped solve or clarify your issue, please mark as solution and give kudos.

[anilelmastasi]

Hello @mavn ,

When a dataset has RLS enabled It’s marked with IsSecured = true. Any consumer (like a scorecard metric) needs to pass an effective identity to evaluate queries. The scorecard service doesn’t impersonate any user or role, so it fails to evaluate RLS-secured data, and the metric doesn’t refresh.

As a workaround you can Create a Non-RLS "Summary" Dataset for Scorecard Metrics.

+Build a summary table or view in Power BI (or source) that aggregates the data you need for metrics without user-level filtering.
+Store this in a separate dataset with no RLS and link your metrics to this dataset instead.
+The dashboards can still use the original RLS dataset.

This way, RLS remains in place for detailed reports, but scorecards can get updated values from a parallel dataset.

How to do this:

Use a stored procedure, materialized view, or Power Query logic to pre-calculate metric values.
Schedule this dataset to refresh after the main RLS dataset refreshes.

If this solved your issue, please mark it as the accepted solution. ✅