RLS works for one user in a role but not another

[uncgmba]

I have created (what i thought to be) basic RLS.

signon name to repID,,,repID to customer repID.

Sales Rep A works Sales Rep B sees everything.

B does not have any other security A does not.  I have tried both and B with no workspace access as well as both with viewer access.  No changes.  A sees their accounts, B sees all accounts.

I have applied the same test to another separate report dataset and the same thing happens with the same reps.

What could cause this?  Don't know what else to check.

[v-cazheng-msft]

Hi @uncgmba ,

Per the info from you, this issue maybe cause by a limited relationship in your model. If there’s no guaranteed “one” side, we’ll say the relationship is limited. There are two reaons that will make the case:

• The relationship uses a Many-to-many cardinality type (even if one or both columns contain unique values)
• The relationship is cross source group (which can only ever be the case for Composite models)

For more details about Limited relationships, please refer to Model relationships in Power BI Desktop - Power BI | Microsoft Docs.

Limited relationship is a kind of weak relationship, as a result, there will be a potential data leak. So you may need a little bit change to the relationships between your tables. For more details about Issue with limited relationships, you may refer to Row-level security (RLS) with Power BI - Power BI | Microsoft Docs.

Best Regards,

Community Support Team _ Caiyun

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly. If I misunderstand your needs or you still have problems on it, please feel free to let me know. Thanks a lot!

[uncgmba]

thanks but i had previously created the 1 to many by creating other tables and the same thing happened.  Some of our folks went thru 200+ users and 2 have this issue.  trying to see if something is trumping the RLS that is outside of my dataset/workspace

[Tutu_in_YYC]

Can you provide a snapshot if the DAX filters you use for the roles?

[uncgmba]

[email] = userprincipalname()

[Tutu_in_YYC]

The DAX should work. And you mentioned that it works on Power BI Desktop.

Is there a Security Group in the members on the workspace that has Sales Rep B in it?

[uncgmba]

nope...don't get it

[Tutu_in_YYC]

Thats odd, there is no other way to bypass RLS than to have roles of "Member" and up. 

My only guess is there is an AD group that actually contains Rep B in it, and that AD group has the role "Member" or up. 

[uncgmba]

no - this is in a very controlled setting...i can promise no AD group is there that would conflict with B.

[Tutu_in_YYC]

Oh man, this is a doozy. I cant think of any other reason why the RLS is bypassed.

[uncgmba]

sorry A and B are in the same role and i ahve tried VIEWER and nothing on the workspace.

[Tutu_in_YYC]

Im referring to AD Security Group, e.g Employees@domain.com which consists of more people in it.

[uncgmba]

i understand but that scenario does not exist.

[uncgmba]

somtimes RLS works great for me and other times i just can't figure it out...also have had issues where i moved a person from seeing everything to a role and i can't get them to stop seeing everything...like it won't clear the old setting.  Still battling that one also - but for another thread.

[Tutu_in_YYC]

Is the dataset is a separate workspace?

[uncgmba]

dataset is a published PBIX file...reads a sharepoint excel for the employee security...tables it bounces against are SQL queries

[Tutu_in_YYC]

So report and dataset are in the same workspace. I ran out of ideas. I hope others in the community may be able to chime in. 

[uncgmba]

also - it DOES properly work in the desktop with both users if i manually filter to the sign on id.