Need help with Security Groups implementation in PBI RLS

[MDB0609]

Hi all,

Hope you are doing well!

I need help on setting up the security groups (setup in MS Entra Admin center) in my RLS. So, basically trying to ease up the process of acess provisioning. 

So I assign members to this SG and add in my Roles in PBI service, addition of users is quite smooth and it starts reflecting with minutes or seconds. Problem appears when I remove a particular user from my Security Group. The user still able to see same data even after removal from SG.
I saw this article which tells it takes around 5 mins to sync after removal of users in SG. 
https://learn.microsoft.com/en-us/microsoft-365/admin/create-groups/add-or-remove-members-from-group...

But in my case, even after hours the access is still there. Not sure if I am missing any step. Glad if someone can help!

[v-karpurapud]

Hello @MDB0609 

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[MDB0609]

Hi @v-karpurapud ,
First of all, apologies for the late reply on this thread. been busy with lot of stuff recently!

So, I tried recently the access provisioning using these roles and so far so good. I am able to add and remove the users easily. In case of addition, access kicks in withing seconds. 
In case of removal of user in SG, the access kicks in withing period of ~5 mins until now. Can't complain much. 
Although I do understand, this would not be a great practical approach in scenario where we do quick testing on different roles in our PBI dataset. Guess I have to live with that since it still reduce hours of manual effort of addition/removal of multiple users.
The explanation given by you seems quite useful and can be used if we stuck at some place during access provisioning. Marking that as a solution!
Thanks for all the help!

[v-karpurapud]

Hello @MDB0609 

Thats Great! Glad to hear it worked out for you😊.

[v-karpurapud]

Hi @MDB0609 

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[v-karpurapud · Accepted solution]

Hello @MDB0609 

Thank you for reaching out to the Microsoft Fabric Community Forum.

Thank you @Anonymous for your prompt response.

We understand your concerns regarding the implementation of security groups in Power BI RLS. This issue typically arises due to caching and synchronization delays between Microsoft Entra ID  and the Power BI Service. I would recommend the following steps:

1. Caching Delay in Power BI Service

• Power BI caches security group memberships for performance reasons. Even if a user is removed from the Security Group , they might still have access for a period.
• Request the user to sign out and sign back into Power BI to clear cached credentials.

2. Delay in Entra ID Group Sync

• Although Microsoft documentation states a 5-minute sync time, it may take up to an hours in some cases.
• Verify if the group membership has been updated in the Microsoft Entra Admin Center.

3. Role-Based Security (RLS) Not Applied Correctly

• Sometimes, removing a user from an SG does not remove their access if they have direct access via other means (such as being assigned to a workspace or report).

4. Check other security roles and direct assignments.

• In Power BI Service, go to Workspace → Manage Permissions.
• Verify if the user has explicit access to the report, dataset, or workspace.

5. Dataset Permissions vs. Workspace Permissions

• Even if RLS is applied correctly, if the user is a Contributor/Admin in the Workspace, they can bypass RLS.

If the issue persists, feel free to reach out for further assistance!

If my response has resolved your query, please mark it as the Accepted Solution to help others. Additionally, I would appreciate a 'Kudos' if you found my response helpful.

Thank you!

[Anonymous]

Try a new workspace as a developer environment, Publish the pbix file there and test the access.