Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Find everything you need to get certified on Fabric—skills challenges, live sessions, exam prep, role guidance, and more. Get started

Reply
speedramps
Super User
Super User

RLS security in chained datasets

How do you apply RLS (role level security) security across a "chained" datasets?

In Power BI it is possible to “chain” datasets. These chains can be viewed in lineage option.

These lineage flows operates form left to right. (see digaram)


If a dataset on the left has RLS (Role Level Security) rules. How can those RLS rules be inherited by a dataset on the right.


Here is an example:-


I create a dataset  “Sales” in import mode called with 1 table with 3 columns (country, product, amount) with RLS (role level security on country) to split US and China sales. I publish it to Power BI service and it works perfectly.

 

I create a dataset in import mode called “China tax” with 1 table with 2 columns (product, tax). I publish it to Power BI service and it works perfectly.

 

I then create a dataset called “Chained”. I get data from the “Sales” and “China tax” dataset. This creates a chain using direct query. I then add a relationship by product.

I want to be ceratin that if I add a dataset in a chain, that users further down the chain can't bypass the earlier RLS.
For example if a user only has access to China in the Sales dataset, then they should only see China in the Chained dataset.

What is happening, is that the “Managed Role”, “Views as” and “Test as role” buttons are greyed out in the Chained dataset.

I want to be ceratin that if I add a dataset in a chain, that users further down the chain can't bypass the earlier RLS.


Is it possible to define RLS once on a dataset and then inherit these rules in a chain?

What is the best practice for RLS in chained datasets?


Please can fellow super users help me. Thank you:-
@Ashish_Mathur 
@lbendlin
@Greg_Deckler

 

speedramps_0-1683114970449.png

 

speedramps_1-1683115001479.png

 

 

 

3 REPLIES 3
speedramps
Super User
Super User

Thank Ibendlin. That is the behaviour that I was expecting.
However, what is happening, is that the “Managed Role”, “Views as” and “Test as role” buttons are greyed out in the Chained dataset. So I can't test that the roles in the first dataset are being applied to the next dataset in the chain.

There is very little microsoft documentation or examples of RLS in a chain datasets.

 

Fair point. You have to take the results of the chained dataset RLS laying down. You cannot test these unless you have access to that workspace, and you cannot test roles from different datasets at the same time. It's either or .

lbendlin
Super User
Super User

RLS (role level security)

That's not what RLS stands for...

 

 

Think of RLS across chained dataset like filters that are applied on top of each other.  You can take away more rows but you cannot modify what has already been taken away.

Helpful resources

Announcements
July 2024 Power BI Update

Power BI Monthly Update - July 2024

Check out the July 2024 Power BI update to learn about new features.

July Newsletter

Fabric Community Update - July 2024

Find out what's new and trending in the Fabric Community.