Forum Discussion
Need help with Security Groups implementation in PBI RLS
Hello MDB0609
Thank you for reaching out to the Microsoft Fabric Community Forum.
Thank you Anonymous for your prompt response.
We understand your concerns regarding the implementation of security groups in Power BI RLS. This issue typically arises due to caching and synchronization delays between Microsoft Entra ID and the Power BI Service. I would recommend the following steps:
1. Caching Delay in Power BI Service- Power BI caches security group memberships for performance reasons. Even if a user is removed from the Security Group , they might still have access for a period.
- Request the user to sign out and sign back into Power BI to clear cached credentials.
2. Delay in Entra ID Group Sync
- Although Microsoft documentation states a 5-minute sync time, it may take up to an hours in some cases.
- Verify if the group membership has been updated in the Microsoft Entra Admin Center.
3. Role-Based Security (RLS) Not Applied Correctly
- Sometimes, removing a user from an SG does not remove their access if they have direct access via other means (such as being assigned to a workspace or report).
4. Check other security roles and direct assignments.
- In Power BI Service, go to Workspace → Manage Permissions.
- Verify if the user has explicit access to the report, dataset, or workspace.
5. Dataset Permissions vs. Workspace Permissions
- Even if RLS is applied correctly, if the user is a Contributor/Admin in the Workspace, they can bypass RLS.
If the issue persists, feel free to reach out for further assistance!
If my response has resolved your query, please mark it as the Accepted Solution to help others. Additionally, I would appreciate a 'Kudos' if you found my response helpful.
Thank you!
Hello MDB0609
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.
Thank you.
Hi v-karpurapud ,
First of all, apologies for the late reply on this thread. been busy with lot of stuff recently!
So, I tried recently the access provisioning using these roles and so far so good. I am able to add and remove the users easily. In case of addition, access kicks in withing seconds.
In case of removal of user in SG, the access kicks in withing period of ~5 mins until now. Can't complain much.
Although I do understand, this would not be a great practical approach in scenario where we do quick testing on different roles in our PBI dataset. Guess I have to live with that since it still reduce hours of manual effort of addition/removal of multiple users.
The explanation given by you seems quite useful and can be used if we stuck at some place during access provisioning. Marking that as a solution!
Thanks for all the help!
Hello MDB0609
Thats Great! Glad to hear it worked out for you😊.