Power BI Premium RLS

[littlemojopuppy]

I have a tabular model on Azure Analysis Services with RLS defined in the database (roles and permissions).

Can I deploy that exact same model into Power BI Premium with RLS still defined in the model?

[v-kkf-msft]

Hi @littlemojopuppy ,

Does you try to connect to Azure Analysis Services datasource using live connection mode?

See if these documents are helpful:

https://community.powerbi.com/t5/Power-Query/Azure-Analysis-Services-Azure-AD-and-RLS/td-p/134631 

Connect to Analysis Services tabular data in Power BI Desktop 

Implement row-level security in an on-premises Analysis Services tabular model 

If the problem is still not resolved, please provide detailed error information or the expected result you expect. Let me know immediately, looking forward to your reply.

Best Regards,
Winniz

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[littlemojopuppy]

Hi @v-kkf-msft the problem is RLS defined within the data model on Power BI Premium.  It's not supported...has to be implemented in the report.

[GilbertQ]

Hi @littlemojopuppy 

I would suggest publishing via the PBIX into your premium workspace. This will allow to add the required roles. 

The way the roles is stored in PBI Premium is different to AAS or SSAS and this is the only way to get it working!

[littlemojopuppy]

Hi @GilbertQ.  Unfortunately I can't.  But thanks for helping.

[GilbertQ]

Hi @littlemojopuppy 

I am not 100% sure exactly what you are doing, but the roles do work and I have deployed roles to Power BI Pro, Premium and Premium Per user successfully.

One thing for sure is DO NOT add them via Tabular Editor as this is not currently supported and can break your PBIX file. You have to do it via the manage roles in PBI Desktop.

If you have added the roles via Tabular Editor you are best off creating a new PBIX file and brining all your data, relationships etc back in and then configuring the roles in the PBIX.

[littlemojopuppy · Accepted solution]

Hi @GilbertQ.  I don't mean publish a dataset as part of a pbix file.  What I'd like to do is publish an analysis services database directly into Power BI Premium (instead of onto an AAS or SSAS server).  It seems that I can publish the data model without roles into Premium, but not with.

[GilbertQ]

Hi @littlemojopuppy 

Yes this can be done, and it will be done via the Manage Roles in Power BI Desktop or once deployed via SSMS

[littlemojopuppy]

Hi @GilbertQ.  Thanks for replying.  🙂

I deployed a test into Power BI Premium yesterday and was playing around with it.  No issues if I don't deploy roles...failure if I did.  Further, if I added roles to that dataset on Premium using Tabular Editor, failure.  So I was expecting the answer to be "no I can't" because RLS isn't supported on Premium.

What's strange is if I open desktop and connect to that test dataset on Premium, the ability to manage roles is disabled.  🤔

I read in a blog yesterday...either SQLBI or Reza Rad I forget which...that Power BI Premium is supposed to be a "superset" of featues from Analysis Services.  Meaning it was intended to do everything SSAS/AAS can do plus more.  It's Microsoft's area of focus.  But not supporting RLS within the dataset itself seems like a huge, epic fail.

[pichlerpa]

Hi @littlemojopuppy ,

you can connect to your Power B Premium license via SSMS and execute there XMLA scripts. For instance, you can script all your roles from your Analysis Sevices and execute them on Power BI Premium. If you use AD Groups, you also need to ensure to use Azure AD groups.

Patrick

[littlemojopuppy]

Hi @pichlerpa did this change recently?  Because when I tried this a three months ago RLS had to be defined within reports, not within the data model itself.

[pichlerpa]

@littlemojopuppynot sure how it was before. Now, I can confirm that you can recreate roles including RLS on a Power BI Premium dataset. As soon as they are deployed, you can test them the same way as they would be created within Power BI Desktop: https://docs.microsoft.com/en-us/power-bi/admin/service-admin-rls#validating-the-role-within-the-pow...

[littlemojopuppy]

@pichlerpa with a Power BI dataset created in a .pbix file, you have to define roles within the report.  With a data model defined in  Analysis Services data I can define RLS including roles, members and permissions within the data model itself...this is what I'd like to migrate to Power BI Premium.  Thanks anyway.

[pichlerpa]

@littlemojopuppy  I migrated from Analysis Service to Power BI Premium by deploying only the model without roles at the beginning, for this I needed to make some adjustments in the Model.bim file. Afterwards, I skripted the roles inlcuding RLS and Members and manually executed it on the newly deployed and at this time already processed Power BI dataset, the formerly AS model. On top of this shared Power BI dataset (Power BI dataset connection) you can then built upon your reports without having defined RLS in any of your actual reports.

PS: A semantic model migrated from Analysis Service to Power BI Premium is also a Power BI datset, but yes, it gets confusing. It think, this is exactly what you want to achive.

[littlemojopuppy]

@pichlerpa I've seen articles about doing this.  And I've also seen articles from Microsoft advising against doing exactly this.  Good luck with it...