Forum Discussion

kajetanbocek's avatar
kajetanbocek
Regular Visitor
10 months ago
Solved

Object level security for contributors - are separate data sets the solution?

Hi, at my company we have the following situation: We are in the process of adding data from a second module of D365 to PBI. The way this is to be done is through a Fabric Link and from the...
Need Help
  • v-achippa's avatar
    v-achippa
    10 months ago

    Hi kajetanbocek,

     

    Yes this setup will work:

    • The important detail is that group C must not have Contributor/Member/Admin access to the workspace that contains the dataset i.e Workspace A, otherwise RLS/OLS will be bypassed.
    • Keep the dataset in Workspace A and implement RLS and OLS in that model, grant group C Build permission on that dataset and put reports in Workspace B where group C are Contributors.

    This way they can build reports while still being subject to the RLS/OLS defined in the model.

     

    Thanks and regards,

    Anjan Kumar Chippa

audreygerred's avatar
audreygerred
Super User
10 months ago

Hi! RLS and OLS should be handled in the semantic model rather than through the workspace and or app. I also recommend pushing reports to an app from the workspace and have report consumers consume from the app.

 

In the ap you can make audiences and have a report separate reports for each group and one group wouldn't have any visuals from the tables you don't want them to see. However, if we follow least privilege access you would set up RLS or OLS depending on your needs and then still keep report consumers in the app and use audiences as needed.

 

OLS can be achieved using Tabular Editor 2 (version 2 is free, version 3 is not - but OLS can be achieved with version 2): Object-Level Security (OLS) with Power BI - Microsoft Fabric | Microsoft Learn

 

Apps in Power BI - Power BI | Microsoft Learn

https://learn.microsoft.com/en-us/power-bi/collaborate-share/service-create-distribute-apps#create-and-manage-multiple-audiences