PBI App and row Level Security

[hhuddleston]

I am attempting to set up and configure a Power BI App for specific user groups, I have set up an app just for selected users, and I have imported an existing  data model with Row Level Security. The first test user I set up is configured to only access those company locations in Florida, yet when I sign on as the test user, there is no restriction on the data that the "Florida Only" user can access. What am I missing here? any help is appreciated!

Herb

[v-yulgu-msft · Accepted solution]

Hi @hhuddleston,

Please follow the steps described in this article to check whether you have configured RLS correctly.

Besides, please be aware of that, after publishing Power BI Desktop report to an app workspace within the Power BI service, the roles will be applied to read-only members. If you have configured the app workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data.

Regards,
Yuliana Gu

[hhuddleston]

This resolved the issue - once I made the App read-only, it applied RLS. Thanks for the assist.

[mbahonen]

I know this is old, but how to you make the App read-only? The current app workspaces always carry over permissions from the workspace itself. I have users that have Member and Admin permissions in the workspace (and I want them to have that) but also need to use the report as a user with RLS applied per their role. I was hoping to remove the full workspace persmissions from the app workspace and try that, but am not allowed to do so as far as I can tell. 

[v-yulgu-msft]

Hi @hhuddleston,

Glad to hear that. Please kindly mark the helpful reply as an answer so that others having similar concern can benefit from here.

Thanks,
Yuliana Gu

[Bimtng]

Hi Herb.

I assume that you have taken this steps:

1. Created a rule in DAX for giving access just to Florida data in your report.

2. Assigned this rule to the test user in the data set in PWBI service.

3. The test user is not an administrator of the report.

If you have not taken any of this steps, surely the test user could see all data. This is my experience.

Hope it helps.

Best regards.

[Seth_C_Bauer]

@hhuddleston Are you sure you are signed in as the test user and not your account? Depending on how your security is set up, it could be like mine (SSO or simliar) where it appears you are logging in with the testuser in your domain, but it actually recognizes you and signs you in with your creds.

Outside of that. From my understanding RLS should work for members provided they are read only...