How to migrate RLS roles assignment between datasets

[gabrielenicosia]

I have two Power BI datasets (source and target) with identical RLS roles.
In the source dataset, users and groups are already assigned to these roles.

In the target dataset, the roles exist but have no users or groups assigned yet.

I've already migrated dataset access using a powershell script (API) and created the RLS roles using TMDL, but I need to copy all role assignments from source to target.

powershell and tabular editor seem to be not helpful in this case. Maybe i'm wrong though.

Do you have any ideas?

[tayloramy]

Hi @gabrielenicosia, 

I think you can do this with tabular editor. 

https://docs.tabulareditor.com/te3/tutorials/data-security/data-security-setup-rls.html

If you found this helpful, consider giving some Kudos. If I answered your question or solved your problem, mark this post as the solution.

[gabrielenicosia · Accepted solution]

The solution turned out to be much simpler than expected!

All you need to do is open two instances of Tabular Editor:

1. In the first instance, go to File > Open > Model from DB to open the Source Dataset.

2. In the second, open the Target Dataset.

3. Simply copy the desired roles from the Source Dataset and paste them into the Roles folder of the Target Dataset.

Finally, hit Ctrl + S and then Model > Deploy.

That's all there is to it! Sometimes the easiest solution is hiding in plain sight lol

[Mauro89]

Interesting and awesome!
May I ask you @gabrielenicosia  to share if you deploy to an SSAS instance or which instance?
Iam curious if this works in a Fabric environment as well. I just tried and through simply publishing the updated PBI report with the model.bim was not showing the new assignments.

[gabrielenicosia]

I’m deploying directly to a Fabric/Power BI semantic model via the XMLA endpoint, not to an on‑prem SSAS instance. I open both source and target models from DB in Tabular Editor (not as an external tool from power bi desktop, but you have to open it as a standalone application from start), copy the roles, then on the target I just save and use Model > Deploy back to the same workspace. In this setup the role assignments show up correctly in the Fabric service.

[v-echaithra]

Hi @gabrielenicosia ,

Thank you for confirming that issue has been resolved an sharing the resolution. If further assistance is still required. We are available to support you and are committed to helping you reach a resolution.

Best Regards,
Chaithra E.

[gabrielenicosia]

Hello tayloramy,

Thanks for your reply. While the article explains how to create a new role using Tabular Editor, I actually need to copy all existing roles and assignments from one model to another in a single operation.

[Mauro89]

Oh @tayloramy @that Sounds interesting. Never tried this. Thanks worse trying. But this also is not capable of doing some kind of automated copy of one security setup to another new one right?

[Mauro89]

Hi @gabrielenicosia,

as far as I know there is now out of the box way to do that. 
I saw an article from DataMarc where he mentioned that some of his code snippets might be useful for this case. Check it out here:

https://data-marc.com/2023/04/12/simplifying-security-replication-in-power-bi-a-step-by-step-guide/

Best regards!

PS: if you find this helpful leave some kudos and mark it as solution. 

[gabrielenicosia]

Hello Mauro,

Thank you so much for your reply. That's a very interesting article; however, in my case, I need to duplicate the single user/group assignments that I made in the Power BI Service from the source model to the target model.

[Mauro89]

Hi @gabrielenicosia 

Ok got it. Another thing which came into my mind is, also best practice ;-), to not assign single users to the RLS roles, rather than managing the users in a Entra ID group. This lets you assign a single group to both semantic models and you do not need to assign every single user every single time. Also this is less error prone as you manage the relation once in the group. No need to maintaine the roles in both semantic models.

Best regards!

PS: if you find this helpful leave some kudos and mark it as solution.