RLS on Power BI Service not working as in Power BI Desktop

[tunglinhpham]

My data model: User table contains Username & Department(s); 4 tables (let's call it A, B, C, D), all linked to the User table using Department column (many to many relationships, Single filter direction - User filters A, B, C, D ). I created a role RegularUser with the filter Username = UserPrincipalName(). When I test the dashboard in PBI Desktop using View As, the displayed result is all correct: user can only see the data of their assigned departments. However when I publish the dashboard into a Premium Workspace & add the users into the RegularUser role, they can see all the data instead of just the assigned departments.

Access to the Workspace is granted using Azure Security Group. I'm in the Contributors group, while all regular users are in Viewers group.

Edit: Just noticed that the error only happens with user being granted 2 or more departments. For user with only 1 department, they can only see the data of that department. I'm suspecting that something's wrong with my many-to-many relationship in the data model.

[ajohnso2 · Accepted solution]

Hi, please ensure your 'users' are not members of the workspace where your report is published, this will overide any RLS and they will essentially have full access.

Create an app, add your report and add your users as viewers to the app (remove them from the workspace security)

[SaiTejaTalasila · Accepted solution]

Hi @tunglinhpham ,

RLS works for  only viewer role on the workspace.Any access above it causes the issue.Please check below article 

https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security

I hope it will be helpful.

Thanks,

Sai Teja 

[ajohnso2 · Accepted solution]

Hi, please ensure your 'users' are not members of the workspace where your report is published, this will overide any RLS and they will essentially have full access.

Create an app, add your report and add your users as viewers to the app (remove them from the workspace security)

[mohitkumawat]

Hi @tunglinhpham ,
Verifying your RLS settings "Test as user" functionality in Power BI Service for a more accurate picture. if the Power BI RLS issue or if Azure Security Group is having issue.then add one regular user to Contributors group and test out RLS.

[tunglinhpham]

Thanks mohitkumawat. I've already did that. When the user's in the Contributors group, the Test function in PBI Service will display a red notice that this user has the Write permission so RLS won't work.

In PBI Service, when I try to test with user not added in the Regular User group, nothing will be shown (as intended), but once they're added into the RegularUser group, they can see everything despite having only the read permission, no warning in this case.

My data model