Forum Discussion
Kudo KingpinRLS Limitation & Improvements
I understand that RLS (role level security) is such that ALL users must be explicitedly given a role, otherwise they won't be able to access any data even if they have full read access.
This is rather inconvenient and error-prone: for example, a report with 200 users that only 30 uers need to be restricted into 4 roles, instead of just the 30 users, all 200 users must now be defined, which not only takes time, but prone to error (for example, if user list changes over time, but admin forgot to update)
I think there should be an option to allow either explicitedly define all users, or allow undefined/anonymous access based solely on existing (reading) access of PBI service, admin can pick & choose either. This will give max flexibility to everyone.
Hi QC
- Using AD security groups to share reports,
- Separate reports from their datasets in different Workspaces
- Create App environment for Reports/Dashboards where these security groups can consume reports
- Add reports into different Audiences in App environment
- Add security groups to specific audiences
All those actions can help you govern who can see what.
For further control you can create a metric report to visualize reports access
Hi QC
Thank you very much for your question about RLS. As you said, users need to be assigned roles, which is really not easy to manage.
However, there are ways to help you manage RLS, and you can try them:
You can enable dynamic security within Power BI Desktop by making use of the username() or userprincipalname() DAX functions and having the proper relationships configured.
Select “Apply security filter in both directions”, which ensures consistent filtering of the data across the table.
You can also manage users in a security group. You only need to assign a role to the group, and removing or adding a user to the group doesn’t require the user to be assigned a role again.
If you want to know more details, you can check out the link below:
https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls#define-roles-and-rules-in-power-bi-desktop
Regards,
Nono Chen
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
3 Replies
- aj1973
Community Champion
Hi QC
- Using AD security groups to share reports,
- Separate reports from their datasets in different Workspaces
- Create App environment for Reports/Dashboards where these security groups can consume reports
- Add reports into different Audiences in App environment
- Add security groups to specific audiences
All those actions can help you govern who can see what.
For further control you can create a metric report to visualize reports access
Hi QC
Thank you very much for your question about RLS. As you said, users need to be assigned roles, which is really not easy to manage.
However, there are ways to help you manage RLS, and you can try them:
You can enable dynamic security within Power BI Desktop by making use of the username() or userprincipalname() DAX functions and having the proper relationships configured.
Select “Apply security filter in both directions”, which ensures consistent filtering of the data across the table.
You can also manage users in a security group. You only need to assign a role to the group, and removing or adding a user to the group doesn’t require the user to be assigned a role again.
If you want to know more details, you can check out the link below:
https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls#define-roles-and-rules-in-power-bi-desktop
Regards,
Nono Chen
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.
Hi QC
- Create proper RLS roles for user to consume report, for your scenario, you need to create 5 roles indeed. 4 roles for 30 users, 1 role for users who need to fully view report. You can create RLS role like this, this does not make any logical judements on the table itself, and user with this role can fully view report
- Use AD Group Security to manage people and add AD Group to the roles you've been created, or you can directly add these 200 users under the RLS roles you created
- Users who have workspace role contributor/member/admin can view all data since no RLS appplies to them
- Create proper RLS roles for user to consume report, for your scenario, you need to create 5 roles indeed. 4 roles for 30 users, 1 role for users who need to fully view report. You can create RLS role like this, this does not make any logical judements on the table itself, and user with this role can fully view report
