Forum Discussion
RLS causes that the users not in RLS group can't access the data
Hi, there,
I created an RLS group by precisely following the instructions https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls.
- I have an existing report "REPORT A" and it has a user "USER X" and a group "GROUP Y" with "viewer" permission.
- Create a role "ROLE B" in "REPORT A" in PowerBI Desktop
- Set a DAX filter on a field of the table for this role
- Publish it to the PowerBI service
- Add an SG "RLS_SG" to the role "ROLE B" in the PowerBI service security tab
- Add "USER Z" to SG "RLS_SG"
Then I find:
- "USER Z" can only access the rows secured by "ROLE B" as expected
- However, "USER X" and the users in "GROUP Y" can't access "REPORT A" due to an error "The report can't be viewed because the underlying dataset uses row-level security (RLS)"
What causes this error? The instruction https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls doesn't mention the existing users and groups added before RLS, and I assume the right design is keeping those viewers' access as it is. Am I wrong? How can I fix this issue?
Hao
USER X and GROUP Y have to be assigned with an RLS Role. If these 2 are allowed to see all data in REPORT A, you still need to create an RLS role without any data filter in it and assign it to USER X and GROUP Y.
Basically, if a report has RLS, only those with assigned RLS roles can access it.
2 Replies
- Tutu_in_YYC
Super User
USER X and GROUP Y have to be assigned with an RLS Role. If these 2 are allowed to see all data in REPORT A, you still need to create an RLS role without any data filter in it and assign it to USER X and GROUP Y.
Basically, if a report has RLS, only those with assigned RLS roles can access it.- AnonymousNot applicable
Thanks Tutu_in_YYC ! I make it as an accepted solution.
It is so sad I can't see this important information on the PowerBI documentation, even the screenshots used in the document all have only one RLS role which may make the people misused it.