Permission Required - No Access to Underlying Dataset (Premium per User)

[sean_cochran]

I have a report with RLS in a PPU workspace. Another user who has a PPU license has been given:

1. Direct access to the report
2. Direct access to the underlying dataset
3. A functioning security role

The user is unable to access the report - they see a "permission required" error that states they do not have permissions to the underlying dataset. I have read up on this issue, and it often it is caused by not having a role assigned - but this individual does have a role.

Does anyone have any ideas how to fix this? I would contact MS support, but it appears they've removed support case rights for PPU users.

[v-lgarikapat · Accepted solution]

Hi @sean_cochran ,

Thanks for reaching out to the Microsoft fabric community forum.
@nandic  @sergej_og  Thanks for your Prompt Response
@sean_cochran 

Quick Fix Steps for Power BI Permission or RLS Access Delays

1. Confirm User Licensing and Role Assignments

• Verify the user has the correct Power BI license (e.g., PPU if needed).
• Double-check the RLS roles are properly assigned in the dataset.
• Confirm user access to the workspace and report is granted.

1. Force Token Refresh by User

• Ask the user to sign out of Power BI.
• Clear browser cache or try in an incognito/private window.
• Sign back in and retry the report.

1. Unassign and Reassign Roles and Permissions

• Unassign the user from the RLS role.
• Wait a few minutes.
• Reassign the user to the RLS role again.
• Do the same for any permissions on datasets or reports if applicable.

1. Share or Grant Access to an Additional Report or Dataset (Optional)

• Sometimes adding access to another report/dataset in the same workspace or environment can “trigger” a refresh of the user’s permissions.

1. Check Dataset Refresh and Cache

• If the dataset is cached or recently refreshed, trigger a manual dataset refresh.
• Sometimes stale data or cached RLS rules can cause access issues.

1. Wait and Monitor

• Although frustrating, some permission changes can take up to several hours to fully propagate.
• If possible, plan changes with a buffer to allow propagation.

1. Use Power BI Tools to Validate

• Use the “View as role” feature in Power BI Desktop or service to test the RLS logic.
• Use the Power BI Admin Portal or Audit Logs to check user access events.

If this post helped resolve your issue, please consider giving it Kudos and marking it as the Accepted Solution. This not only acknowledges the support provided but also helps other community members find relevant solutions more easily.

We appreciate your engagement and thank you for being an active part of the community.

Best regards,
LakshmiNarayana.

[sean_cochran]

Thank you for this response, Lakshmi! The issue has already resolved itself (I am guessing that the "wait and monitor" bullet was the solution), but I will mark this post as the solution since it has such a comprehsnive list of options to try. Hopefullly this will give others a place to start if they encounter similar problems in the future.

[nandic]

@sean_cochran , when it comes to account issues, there are no known issues.
I mostly mean on issue with security settings and manual errors.
Example, mistake in RLS or mistake when adding a user.
It happened to me when i had users with very similar email, whenever there were any kind of settings for them, intellisense always offered the first user so users automatically selected that user by mistake.

So, at this point, first check is if this user can access other reports and semantic models.
The second check, to see if RLS logic for this user is correct.

If everything is fine locally and when you test his role in Power BI Service, then try adding him as a contributor to a workspace.
By doing this, RLS will be overriden and the user will see everything. That means that RLS is the issue.

Cheers,
Nemanja

[sean_cochran]

I confirmed that it is the correct user and that the RLS role logic works in the service. I assigned other reports to the user, but we never got the chance to test them because the original report abruptly started working for them yesterday. This was two days after giving them a PPU license and granting them access/permissions/security role. The only changes I made were a) unassigning and reassigning the RLS role, b) unassigning and reassigning permissions, and c) granting access to other reports. I had done both a and b multiple times before starting this thread on Tuesday and it did not solve the issue at the time. I would be surprised if adding permissions to unrelated reports fixed the issue, but who knows.

Unless adding permissions to unrelated reports triggered something, I'm guessing that giving the system a little time was the key. Perhaps permissions were still propogating through our Power BI environment?

[nandic]

@sean_cochran , first thing to point out here: MS support will not be able to solve this.
Do not waste time.

You mentioned that five other users with identical permissions can access data, so permissions are fine.

Need to find what is unique for this user:
1) different RLS comparing to other users? 
2) issue with his account? Can he access any other report?

You tested RLS locally and it worked fined.
Did you try testing it in Power BI Service (Semantic Model > security > roles > test as role)?

Cheers,
Nemanja

[sean_cochran]

I hadn't tested either of those yet! I just tested the role, and it works in the service. I gave him access to other reports. I'll report back on those.

In the meantime - are account issues a known problem?

[sergej_og]

Do you have a cascading datasets/dataflows structure which are the base for your final sematic model?
If yes, you need to provide access to all involved datasorces to your users.

[sean_cochran]

The semantic model is based only on dataflows. The only objects with permissions are the report and the semantic model.

There are five other users with identical permissions other than the security role that can access the dashboard successfully. I tested the security role in desktop and it works. In the service, the security role is assigned to the correct individual, and I verified that the individual has PPU access.