Forum Discussion
RLS user with two roles generating error when accessing via workspace app, not via direct link
I haven't used apps in a while but if memory serves, you need to publish changes made to its component artifacts (e.g. report, dashboard) after its creation. Can you check that the app has the latest version of the dataset with RLS rules built in? Maybe it needs to be republished if it was created before RLS were part of the underlying PBIX.
Hi aseagull
First off you certainly can get any account you want, Microsoft does not place any limits on account creation.
Second I would suggest working through it with a test account.
And also even though currently you have to work through List A and List B this will be quite hard to control and manage in Power BI with RLS due to the overlap of the groups.
What I can say about RLS is that the reason it is working is because RLS uses lowest priviledge, which means that it will use the combintion of roles for the users that are in List A and B.
Hi gil and thank you for your feedback. I will check again with IT. It also occurs to me that maybe I can use that test account that MS offers, though I don't know if it includes the ability to create email distribution lists on an Exchange server.
The weird thing here is that everything works fine if the user reaches the report through his home page in the service (e.g., via "shared with me"), but when he goes through the app for the workspace, he gets errors. Honestly, it feels like a bug...unless MS makes no promises as to the behavior when a user participates in multiple roles.
I will check again into creating a test account. If it simply verifies what I've already seen with two users, is this simply a bug with apps? I asked a simpler version of this question on the GIAC livestream on Saturday 7/2, and they confirmed that it's possible to have a user belong to multiple roles.
GilbertQ (sorry I mistagged the wrong Gil above), FYI I created a parallel environment in a Microsoft developer's account evironment, and could not replicate the error. IT has agreed to temporary create an account on our production system so I can troubleshoot the problem where it sits...to be continued.
I anticipate I may look foolish when this is over.
I haven't used apps in a while but if memory serves, you need to publish changes made to its component artifacts (e.g. report, dashboard) after its creation. Can you check that the app has the latest version of the dataset with RLS rules built in? Maybe it needs to be republished if it was created before RLS were part of the underlying PBIX.
