RLS is working in powerbi desktop but not on powerbi service/workspace

[WinterGarden]

Hi All,

I am facing an issue in which rls is working in powerbi desktop, but not on workspace.
Using a security group to give admin and user access..
Added that security group as workspace viewer.
Still rls is not working.
Do you have any ideas?  

[WinterGarden · Accepted solution]

Hi @ALL,

Thank you so much for all your suggestions.
This issue is now resolved.
These are my findings:
Initially this security group had member access, then we changed that to viewer ..
Even after changing the access to viewer RLS was not working.
Tried all your suggestions as well.. still the same issue..
then we've removed these users from the security group and readded them in to the same group.
After 24 - 48 hrs now RLS is working properly.
I guess if the security group had member access and if we changed that to viewer also, rls wont work. only workaround is that remove the users from the security group and readd them. After 24 to 48 hrs rls will reflect in the service for that report.

Regards,
G

[Anonymous]

Hi @WinterGarden 

Please check if the following troubleshooting steps are helpful to you.
Row-level security (RLS) guidance in Power BI Desktop - Power BI | Microsoft Learn

Best Regards,

Jayleny

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Smalfly]

Hi @WinterGarden ,

what do you mean when you mention that you gave the security group admin and user access?

Can you try to remove the admin access? Does that solve your problem?

[WinterGarden]

security group is basically an user group where i add the users who need to access that report.
In that group is there is no admin or user roles..

[rafpaciorek]

Did you add the security group in question to the RLS role in the Power BI Service as well? You can do that by going to the workspace where your semantic model is, selecting "More options">"Security" then adding the group to the role you have created in Power BI Desktop and clicking Apply

[WinterGarden]

Hi @rafpaciorek ,
yes, added there as well..
This is how i configured the rls/access in workspace
1) granted read access to security group to report and dataset
2)added the security group to user role in security option of dataset
still it is not working..

[rafpaciorek]

And have you tried to "Test as role" on your created role? As a bonus question, when you say RLS is not working, do you mean the end users see all the data, or see no data?

Regarding the "Test as role", if you select to test as one of the persons in the group that is assigned to the RLS role, they should only have Read permissionsRLS

[WinterGarden]

yes, i tried that.
I've created 2 roles
1)Admin
2)Engagement level

problem is that when i test the engagement level role, rls is not working.. ie user can see the admin data

[rafpaciorek]

Would you be able to share the DAX that is used to filter data for those roles?

[WinterGarden]

rls is working when i test it in powerbi desktop..
basically i am using a table where users roles are specificed

Role	IsAdmin	Engagement ID	Engagement Name	User Email
User	0	I-111122	FY24 eng 1	A@gmail.com
User	0	I-111123	FY24 eng 2	B@gmail.com
User	0	I-111124	FY24 eng 3	C@gmail.com
Admin	1			D@gmail.com
Admin	1			E@gmail.com

then, in the manage roles, i created 2 roles Admin and Engagement level

[User Email] = USERPRINCIPALNAME()

[Smalfly]

The userprincipalname() function provides different results in Power BI Desktop and in the service. In Desktop it provides the name of PC, in powerbi.com it provides the login (email) of currently logged user. So I guess it all depends on how you checked whether the RLS is working online or not (who was logged on to the service).

For more information + instructions on how to visualize the userprincipalname(), you can check this tutorial.

[WinterGarden]

Hi,
I've tested that userprinciple name. Created a measure for displaying the userprinciplename(

User = USERPRINCIPALNAME())

and added it into a card in the report.
Published the same report to two different workspace (dev and prod).
It's seems like in the workspace where i am facing this issue when i tested the rls in the security this userprinciple name is showing my name( i've admin access) instead of users mail id used for testing. Where as in the other workspace it is showing the users mail id that is used for testing the user role.
i've admin access to both the workspace. Not sure why this rls is working in dev workspace and not in prod workspace.
do you know what is causing this issue?

[Smalfly]

If you published the same report in 2 workspaces and the 2 copies behave differently, there must be something in the workspace settings that is different.

My best guess would be that in 1 of them, the "users can edit data models in the Power BI service" is turned on and that it is turned off in the other workspace. If that is not the case, you can check the other settings one by one.

[WinterGarden]

That is turned off in both workspace. Checked both the workspace and report settings for two workspace. It's same for both.

[Smalfly]

Strange...

I ran out of ideas here.

However, if you find a solution for your problem, I would be happy to learn from it. So please post the solution/explanation here even if you find the solution outside of this forum.

[Tutu_in_YYC]

Mind boggling..

[Tutu_in_YYC]

Do the users exist in the workspace access with a different role? e.g. A is in a security group with Viewer role, but also in another security group with a Member role

[WinterGarden]

No,
users are only added to that security group with viewer access.