RLS user issue

[BforByron]

Hello,
I am having some issues with RLS in my report. I am sharing a report with various world wide users and need to keep the information limited to each user’s area of responsibility.

I have setup roles in PowerBI desktop and verified they work through view and published it to my online report. I then assigned everyone to their role(area of responsibility) and checked to see that the roles still work on the webapp. All the roles work in the webapp, but when I change the view and use the user’s email addresses some of them will work correctly and some will show all areas, as if the roles are not recognizing the user I am replicating the view of.

I would guess that somehow PowerBI is recognizing who the user is (otherwise they would not have access to the report) but is not recognizing their email/username when checking their RLS. All users have read-only access and I have moved users who have working RLS into groups where no one has working RLS and that user adopts the correct RLS so it seems like a user issue.

Please let me know what you think. 

Thank you
Byron Norris

[v-diye-msft]

Hi @BforByron ,

If the report is stored in My Workspace, we can share the report or related dashboard with these users, they will see corresponding data based the role he/she belong to. 

If the report is stored in a app workspace, as long as the users are this app workspace read-only members, they can view the report and dashboard with role filtered. 

Let me know which RLS you set, Static RLS /Dynamic RLS? Did you put them into group and manage the group in DAX when seeing RLS?

Make sure you didn't give the person (who can see all the report) the accessibility to the dataset in another report, otherwise they can see all the report created based on the same dataset. 

[BforByron]

Hi Dina,

The report is shared in a team workspace that all the users are members of. I am not the owner of the workspace but I do not believe these users would have any access beyond read only due to their positions. Could be possible.

This is just static RLS, I set up the roles and defined the views using the DAX input then added the users to the roles in the dataset. 

This is the only report based on this dataset and all these users are new to it.

[GilbertQ]

Hi there

If the users are members for the Classic Workspace, even with read-only access they will still see all the data.

[v-diye-msft]

Hi @GilbertQ ,

I think you should refer to New app workspace rather than classic workspace. 

For new app workspace, RLS works when the role is viewer. Anyone with Member/Contributor/Admin ignore RLS.

For classic workspace , RLS works when the role is read-only member. Anyone in the workspace with Write access will ignore RLS.

Hi @BforByron ,

I would suggest you to set the report based in your own workspace, and try again. if the issue still exist, please raise your ticket to https://powerbi.microsoft.com/en-us/support/

[BforByron]

Due to workplace restrictions I can not create a new workspace. Is there anyway to implement this on the existing workspace?

Is there anyway to implement RLS on users who are members of the workspace?

[GilbertQ]

Hi there

As I understand it, you would need to move to the New App Workspace to allow members with the Viewer Role to have RLS applied.

The only other option is to remove the users as members from the current Workspace.

[GilbertQ · Accepted solution]

Hi there

I was referring to the classic workspace in that there was a known bug even if the users had READ-ONLY access they could still see all the data.

This has only been fixed with the New App Workspace and the Viewer role.

[v-diye-msft]

Hi @GilbertQ ,

Oddly, I've just tested the RLS under read-only role in classic workspace, it works great as always!

Could you please test it in your side ?

[GilbertQ]

Hi there

For those users who can see everything can you make sure that they are NOT a member of the App Workspace?

If a user is a member of an App Workspace they will be able to see all the data.

If you are using V2 of the App Workspace they can be assigned as the VIEWER role, which will then keep RLS