RLS causes that the users not in RLS group can't access the data

[PBI-designer]

Hi, there,

I created an RLS group by precisely following the instructions https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls.

• I have an existing report "REPORT A" and it has a user "USER X" and a group "GROUP Y" with "viewer" permission.
• Create a role "ROLE B" in "REPORT A" in PowerBI Desktop
• Set a DAX filter on a field of the table for this role
• Publish it to the PowerBI service
• Add an SG "RLS_SG" to the role "ROLE B" in the PowerBI service security tab
• Add "USER Z" to SG "RLS_SG"

Then I find:

• "USER Z" can only access the rows secured by "ROLE B" as expected
• However, "USER X" and the users in "GROUP Y" can't access "REPORT A" due to an error "The report can't be viewed because the underlying dataset uses row-level security (RLS)"

What causes this error? The instruction https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls doesn't mention the existing users and groups added before RLS, and I assume the right design is keeping those viewers' access as it is. Am I wrong? How can I fix this issue?

Hao

[Tutu_in_YYC · Accepted solution]

USER X and GROUP Y have to be assigned with an RLS Role. If these 2 are allowed to see all data in REPORT A, you still need to create an RLS role without any data filter in it and assign it to USER X and GROUP Y.

Basically, if a report has RLS, only those with assigned RLS roles can access it.

[PBI-designer]

Thanks @Tutu_in_YYC ! I make it as an accepted solution.

It is so sad I can't see this important information on the PowerBI documentation, even the screenshots used in the document all have only one RLS role which may make the people misused it.