Forum Discussion
RLS overwritten by Gateway
Hello,
In our tenant, we use security groups to provide access to reports; these reports are published by app.
The datasets are shared Power BI Datasets in the online service.
The datasets themselves are live connections on SQL servers; whereas cubes are predefined.
In the backend, it is possible to add RLS into the models, but the gateway - which connects the Power BI Dataset with the cubes - looks to overrule these type of settings.
Is there any workaround, so we still could use RLS in the backend and keep shared datasets as well?
Thank you in advance!
Hi Alexander. Usually this shouldn't happen. Let's see. The only thing I can think about is that your Dataset is connected via Direct Query to the source. If you're using DirectQuery, the security roles in your data source (SQL Server) are used. When a user opens a report Power BI sends a query to the underlying data source, which applies security rules to the data based on the user's credentials. Unless you have a strong reason to use direct query I would suggest using import data. If you import your data you can control the security with RLS from the dataset and you have plenty of adventages of features and transformations.
I hope that helps,
2 Replies
Hi Alexander. Usually this shouldn't happen. Let's see. The only thing I can think about is that your Dataset is connected via Direct Query to the source. If you're using DirectQuery, the security roles in your data source (SQL Server) are used. When a user opens a report Power BI sends a query to the underlying data source, which applies security rules to the data based on the user's credentials. Unless you have a strong reason to use direct query I would suggest using import data. If you import your data you can control the security with RLS from the dataset and you have plenty of adventages of features and transformations.
I hope that helps,
Hi ibarrau,
Thank you for your answer. Good to know it should not overwrite it.
The case that we use DQ/Live instead of Import is the fact that it's a managed environment, with a managed BI implementation. We'll struggle along, but thank you for letting us know that it should not be the case of any overwriting.