Power BI Sharepoint Row-Level Security

[NickHall]

Hi,

I'm trying to enable row-level security in a sharepoint report but am really struggling with it.

In PowerBI desktop, I've setup some RLS using a Sharepoint User Information List to match sharepoint users to a database I'm reporting on. I've then set up a role that filters the Sharepoint User Information 'Username' column based on the USERPRINCIPALNAME() DAX expression. The RLS works perfectly on PowerBI desktop if I click 'view as' and tick the role and provide the userprincipalname for the user I want to filter on.

This falls down immediately when I publish to app.powerbi.com. Adding users to the role via dataset security appears to work fine, but I can't choose to view the report as a role AND as a specific user, so the RLS doesn't apply and I can see everything. Embedding it in Sharepoint has the same issue.

How can I get Sharepoint to use roles I've created and provide the user principal name?

[Anonymous · Accepted solution]

@IF you publish your Power BI Desktop report to a workspace within the Power BI service, the roles will be applied to read-only members. 

Hope it resolves your issue? Please consider accepting it as the solution to help the other members find it more quickly.

Appreciate your Kudos, Press the thumbs up button!!👍

[v-stephen-msft · Accepted solution]

Hi @NickHall ,

For users who have editing rights to reports, RLS does not work.

About validating the role within the Power BI service, you may refer to:

https://docs.microsoft.com/en-us/power-bi/admin/service-admin-rls#validating-the-role-within-the-pow...

The requirements of embedding a report web part in SharePoint Online, you may refer to:

https://docs.microsoft.com/en-us/power-bi/collaborate-share/service-embed-report-spo#requirements

Best Regards,

Stephen Tao

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous]

@NickHall Firstly are you using the latest version of power bi ?as far as i know admin of workspace will be able to see all the data even though RLS is implied....

[NickHall]

Hi, thanks for the reply. I am using the latest version of PowerBI Desktop (not the UWP version) and the latest look & feel of app.powerbi.com. Two users tested the report. One was a workspace admin and the other did not have access to the workspace, but was a PowerBI admin which may have caused the RLS to not apply?

Why is that a feature? Surely RLS should apply to everyone?

I'll try it with another user who has none of the permissions the other two have and get back to you. Thanks.

[Anonymous · Accepted solution]

@IF you publish your Power BI Desktop report to a workspace within the Power BI service, the roles will be applied to read-only members. 

Hope it resolves your issue? Please consider accepting it as the solution to help the other members find it more quickly.

Appreciate your Kudos, Press the thumbs up button!!👍