Hi,
We've set dynamic RLS in one of our premium spaces, the idea is to share it with external collaborators registered in our azure aad.
The report:
- User table with store code and one user per column
- Fact table that is filtered by the user table with the store code (many to one relationship)
- RLS Filter, filters [user] = principalusername, so that only one station remains to be seen (the one that matches the store code this user has in the user table)
- We've also made sure that the userprincipalname return has the same syntax that the user we've set in our users table so there is always a match.
The RLS is working because previously to being added to a group in security settings they cant see anything with a warning about rls being applied.
But here is the problem, once the external user is added to the RLS group with the Dax RLS filter (user = Principalusername) they can see everything in the report, as if there was no filter.
This only happens with external users, as with the users that have an internal email address they can only see the stores they are assigned to in the users table. Also, none of the users is an admin or have share permissions in the premium space.
Same dataset, RLS filter and structure but with a different outcome between internal and external accounts, any help? Thanks
