RLS Question

[jl20]

Hi all,

I have a report that I am posting to two dashboards within the same workspace. I need some help configuring the RLS settings.

Dashboard A - All Management has access. The report is in its unfiltered form.

Dashboard B - Only a subset of All Management, let's call them Group X, have access. I want to filter the report so that when Group X logs in, they only see a filtered report based on the criteria I specify.

My question is: For the users in All Management AND Group X, which security filter will apply (i.e., if a user is in Group X will they see the whole thing or will the report be filtered)?

Given that the report is manually refreshed weekly, I'd like to set it up so that I'm only dealing with one report, and not having to post a distinct PBIX file for each dashboard.

Any insight would be appreciated!

[jdobrzen · Accepted solution]

I asked myself a similar question a few weeks back and provide my findings from some testing I performed.

If one security role has RLS logic and the other does not, the users belonging to both will see everything.

http://community.powerbi.com/t5/Service/RLS-cumulative-security/m-p/353714/highlight/true#M39624

[Tadder]

yes that is correct.

[Tadder]

In my experience if a user is in two groups the LESS restrictive one gets assigned.  So this would work for Group A (Management).  For Group B you'd just have to set the criteria for what they can see and assign them.

[jl20]

Got it - so in this instance, it's probably just easier to post two separate reports with each filtered appropriately.

[Tadder]

No, you can use one report with two roles.  The roles should allow users to see what they are authorized to see.