RLS Only Works For Some Users

[Lee_D2022]

We have a problem with our RLS whereby it is working for some users and not others, for these it is displaying all records unfiltered.

All users have the same permission level for the Workspace and they are all in the same role (and they are not duplicated across roles either).   Also, this issue is across multiple Workspaces and datasets.

I've removed the workspace, recreated it, etc. as still the problem persists.

Any other suggestions would be greatly appreciated as Google has let me down  😊

[Lee_D2022]

Hi

Thanks for the reply (and apolgies for not getting back sooner)

The users have the same permissions level in the WS (viewer) and are in the same RLS security group.

There are 2 different datasets in the WS and the problem persists for the same users across dataset

[otravers]

Do you have an RLS role that can view everything? What's the DAX expression that defines it?

[Lee_D2022]

It passes userprinciplename to the users name (code below)

There is a role that sees everything.  This doesn't have any filters applied.

DAX

Username =

var atpos = iferror(search("@",USERPRINCIPALNAME()),0)

return

if(atpos > 0,SUBSTITUTE(left(USERPRINCIPALNAME(),atpos-1),"."," "),"Error")

[otravers]

I suggest you create a table in a new report page with each user's UPN and then a column with that DAX expression. Publish it in the service to see the UPN resolve to emails.

[Lee_D2022]

That sheds a little more light on the situation.  The problem users are returning my name and, as I'm in the see all group, they can then see all.

Why would this happen for some users and not all of them?  Could it be how their profile is set up?

[otravers]

Yeah I'd review these users' profiles in AAD and how they're different from those that work as expected.

[Lee_D2022]

Just sat with the IT team and compared AAD profiles and there's nothing discernably different between the two.

[otravers]

What happens if you just use USERPRINCIPALNAME() as the DAX expression for the "see all" profile instead of your conditional logic?

[Tutu_in_YYC]

Did you add them to the workspace with a role other than "Viewer", if yes, that would overwrite the RLS. Only "Viewer" works with RLS.

[otravers]

This is the most likely explanation. I blame Microsoft for defaulting to Member when you add users to a workspace.