RLS for External Users - Future Feature?

[kelv]

Hi,

As of the June 2017 Power BI release, it doesn't appear to be possible to assign RLS roles to a user who has an email address which is outside of my organization. Does anyone know whether Microsoft are to implement this feature anytime soon?

The data is really sensitive so I need to filter based on permissions - filtering based on the URL is not an option.

[v-jiascu-msft]

Hi @kelv,

I think @GilbertQ already gave the answer and workarounds. You could reference here: powerbi-admin-rls

"External sharing is not currently supported with datasets that use RLS."

Or maybe you could vote an idea here: rls-for-users-outside-of-organization

Best Regards!

Dale

[kelv]

Thanks for the link Dale, I have voted 

[GilbertQ · Accepted solution]

Hi @kelv

I can confirm to the best of my knowledge that you currently cannot implement RLS to an external user.

I am sure that they are working on this, but it is not currently available. The workaround is to embed Power BI into an application and then use Access Tokens.

The only other solution that I can come up with is to either then have seperate reports with the external users data already filtered out. Because then you can share the dashboard with them? (Which depends on the number of external users can potentially be a lot of work).

Or to create and pay for a Pro license in the current clients tenant.

[kelv]

Hi guavaq,

Thanks for your brilliant answer! If using different reports with the data filtered out, are the end users able to clear the filters and/or change the URL in the address bar to alter the filter themselves? (this is something I need to avoid).

With regards to the Pro License, I'm not entirely sure what I would gain. Could you elaborate a bit more please? Note that I don't really want any users to modify reports; only to view what I have set up for them.

[GilbertQ]

Hi @kelv

If you create a report where you have filtered the data out, it will not exist in the dataset, so because the data is not actually stored in the dataset they will only be able to see their data.

If the users are logging into your Power BI area, they would require a Pro license to view the dashboards that you shared with them (which would be read only including the underlying reports). Or they could access the data via the Apps, which once again is read only and they would not be able to modify anything.