Issues in Dynamic RLS - one of my user is by-passing the RLS rule and able to see all data.

[Rajnish366]

In my RLS enabled report on Services. one of report user is able to see all data by by-passing RLS rule . Can some one Help me out to find the possible reason.

RLS is based on Branch level 1 to many relation followed by Userprinciple () function to recognise the user.

[GilbertQ · Accepted solution]

Hi @Rajnish366 

Please make sure that the user does not have any roles in the workspace, as that will allow them to see all of the data. except for a viewer role, any other role, and they'll be able to see all the data.

[v-menakakota · Accepted solution]

Hi @Rajnish366 ,

Thank you for reaching out to us on the Microsoft Fabric Community Forum.

As @GilbertQ  mentioned, Ensure that the user is assigned to appropriate role within the workspace. As mentioned, any role with higher than 'Viewer' (such as Contributor, Member, or Admin) can bypass RLS and access all data, regardless of the RLS settings.

Providing the documentation link which might help you in clear understanding:

Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn

If this post was helpful, please give us Kudos and consider marking Accept as solution to assist other members in finding it more easily.

[Rajnish366]

Hi GilbertQ,

While debugging this issue we found that the Cost centers (used for join ) in my Dim table are not available in my Fact table and RLS user is able to see all CCs (not available in fact table) along with his/her own CCs data.

Is there any way to restrict in Manage roles (Dax) that the user will able to see his/her own data only even if CCs are not present in Dim table but available in Fact table.

[v-menakakota]

Hi @Rajnish366 ,

I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please Accept it as a solution and give it a 'Kudos' so others can find it easily.

Thank you and Regards,
Menaka.

[v-menakakota · Accepted solution]

Hi @Rajnish366 ,

Thank you for reaching out to us on the Microsoft Fabric Community Forum.

You can modify the RLS filter in Manage Roles to ensure that users see only their assigned Cost Centers (CCs) that exist in the Fact Table.
Approach 1 :Apply RLS on the Fact Table Instead of Dim Table.

Approach 2:If you must apply RLS on the Dim Table, ensure it filters out CCs missing in the Fact Table.

If this post was helpful, please give us Kudos and consider marking Accept as solution to assist other members in finding it more easily.

Regards,
Menaka.

[v-menakakota]

Hi @Rajnish366 ,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Regards,
Menaka.

[v-menakakota]

Hi @Rajnish366 ,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you and Regards,
Menaka.

[v-menakakota · Accepted solution]

Hi @Rajnish366 ,

Thank you for reaching out to us on the Microsoft Fabric Community Forum.

As @GilbertQ  mentioned, Ensure that the user is assigned to appropriate role within the workspace. As mentioned, any role with higher than 'Viewer' (such as Contributor, Member, or Admin) can bypass RLS and access all data, regardless of the RLS settings.

Providing the documentation link which might help you in clear understanding:

Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn

If this post was helpful, please give us Kudos and consider marking Accept as solution to assist other members in finding it more easily.

[v-menakakota]

Hi @Rajnish366 ,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[GilbertQ · Accepted solution]

Hi @Rajnish366 

Please make sure that the user does not have any roles in the workspace, as that will allow them to see all of the data. except for a viewer role, any other role, and they'll be able to see all the data.