Multiple Roles in Row Level Security suddenly starts causing errors for users

[Amerivike]

We have had our row level security configured like this for a long time. After the December update, suddenly users that are part of two different security roles are getting an error that says "The user belongs to multiple roles that have security filters, which isn't supported when one of the roles has filters affecting table 'StoreList' with SecurityFIlteringBehavior = Both relationships.

Depending upon a person's role, their User Principal Name may hit the Manager NTID table or the NAGDC.Dim User Store table. Some users that need a temporary access change also flow into the Alternate Access table which puts them in two different roles. Prior to the December update, the two roles created a "union" of the access. The user flowed through the Row Level Security on both tables.

Suddenly this is causing an issue and I am not seeing a lot about it (although I did find one post with no real solution however). Is there any new information on what appears to be a bug or someone know a work-around?

Thank YOU!

[v-luwang-msft]

Hi @Amerivike ,

There is a similar thread that you could reference firstly.

https://community.powerbi.com/t5/Desktop/Row-level-security-and-bidirectional-cross-filtering/m-p/81...

If it can't work for you, please share a dummy file that we can test. 

Best Regards

Lucien

[spowell]

I had a similar problem that I posted here a few weeks ago, and there are basically 2 solutions we identified.

The first is to create a single security role for each user that explicitly defines which rows of which tables they do and don't have access to (time-consuming but doesn't require changing the data model at all).

The second is to create intermediary tables for any tables in the model that currently have a many-to-many relationship and instead linking those tables to the intermediary table in many-to-one relationships (requires changing the data model a bit, but saves time in the long run and reduces the potential for human error). I described the exact method I used to do that in the update here.