Forum Discussion

kajetanbocek's avatar
kajetanbocek
Regular Visitor
11 months ago
Solved

Object level security for contributors - are separate data sets the solution?

Hi, at my company we have the following situation: We are in the process of adding data from a second module of D365 to PBI. The way this is to be done is through a Fabric Link and from the...
Need Help
  • v-achippa's avatar
    v-achippa
    10 months ago

    Hi kajetanbocek,

     

    Yes this setup will work:

    • The important detail is that group C must not have Contributor/Member/Admin access to the workspace that contains the dataset i.e Workspace A, otherwise RLS/OLS will be bypassed.
    • Keep the dataset in Workspace A and implement RLS and OLS in that model, grant group C Build permission on that dataset and put reports in Workspace B where group C are Contributors.

    This way they can build reports while still being subject to the RLS/OLS defined in the model.

     

    Thanks and regards,

    Anjan Kumar Chippa

audreygerred's avatar
audreygerred
Super User
11 months ago

Hi! RLS and OLS should be handled in the semantic model rather than through the workspace and or app. I also recommend pushing reports to an app from the workspace and have report consumers consume from the app.

 

In the ap you can make audiences and have a report separate reports for each group and one group wouldn't have any visuals from the tables you don't want them to see. However, if we follow least privilege access you would set up RLS or OLS depending on your needs and then still keep report consumers in the app and use audiences as needed.

 

OLS can be achieved using Tabular Editor 2 (version 2 is free, version 3 is not - but OLS can be achieved with version 2): Object-Level Security (OLS) with Power BI - Microsoft Fabric | Microsoft Learn

 

Apps in Power BI - Power BI | Microsoft Learn

https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-create-distribute-apps#create-and-manage-multiple-audiences

 

  • kajetanbocek's avatar
    kajetanbocek
    Regular Visitor
    11 months ago

    Hi Audrey,

    Thanks a lot for your reply and the suggestions!

    I have a follow up question:

     

    Would distributing reports through an app and creating audiences limit contributors access to the semantic data model?

     

    It seems to me like sharing through apps impacts which reports are visible but not which parts of the data model a contributor can see. Please correct me if I misunderstand.

    Or maybe giving super users contributor access to a workspace is an outdated way of granting them the necessary access? 

    Many thanks in advance.

    • audreygerred's avatar
      audreygerred
      Super User
      11 months ago

      Contributors have access to everything - OLS and RLS do not apply to them. Going back to least privilege access - if people are not actively developing semantic models I do not give them access to a workspace. People that you want to view your reports should access them through the app. If you are in a self-service situation where you want people to utilize the model to do their own reporting they should not have access in your wrkspace, but they should have build access on the semantic model.