Forum Discussion

Anonymous's avatar
Anonymous
Not applicable
3 years ago
Solved

RLS causes that the users not in RLS group can't access the data

Hi, there,

 

I created an RLS group by precisely following the instructions https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls.

  • I have an existing report "REPORT A" and it has a user "USER X" and a group "GROUP Y" with "viewer" permission.
  • Create a role "ROLE B" in "REPORT A" in PowerBI Desktop
  • Set a DAX filter on a field of the table for this role
  • Publish it to the PowerBI service
  • Add an SG "RLS_SG" to the role "ROLE B" in the PowerBI service security tab
  • Add "USER Z" to SG "RLS_SG"

Then I find:

  • "USER Z" can only access the rows secured by "ROLE B" as expected
  • However, "USER X" and the users in "GROUP Y" can't access "REPORT A" due to an error "The report can't be viewed because the underlying dataset uses row-level security (RLS)"

What causes this error? The instruction https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls doesn't mention the existing users and groups added before RLS, and I assume the right design is keeping those viewers' access as it is. Am I wrong? How can I fix this issue?

 

Hao

  • USER X and GROUP Y have to be assigned with an RLS Role. If these 2 are allowed to see all data in REPORT A, you still need to create an RLS role without any data filter in it and assign it to USER X and GROUP Y.

    Basically, if a report has RLS, only those with assigned RLS roles can access it.

2 Replies

  • USER X and GROUP Y have to be assigned with an RLS Role. If these 2 are allowed to see all data in REPORT A, you still need to create an RLS role without any data filter in it and assign it to USER X and GROUP Y.

    Basically, if a report has RLS, only those with assigned RLS roles can access it.

    • Anonymous's avatar
      Anonymous
      Not applicable

      Thanks Tutu_in_YYC ! I make it as an accepted solution.

       

      It is so sad I can't see this important information on the PowerBI documentation, even the screenshots used in the document all have only one RLS role which may make the people misused it.