RLS

[sajit]

Problem Summary: I've implemented Row-Level Security (RLS) on a Power BI semantic model, but the assigned user cannot see the semantic model in the workspace and gets blank visuals when accessing reports.

RLS Implementation Steps:

1. User Assignment: Added user as Workspace Viewer
2. Security Table: Created dataflow SecurityDepartment with user-department mapping:

   UserName              Department

   user1@xyz.com         100

   user2@xyz.com         200

3. Data Integration: Added the SecurityDepartment dataflow to the semantic model
4. Role Creation: Created RLS role with DAX filter:
   dax

   'SecurityDepartment'[UserName] = USERPRINCIPALNAME()

5. Role Assignment: Assigned the RLS role to the user.
   
   

   Current Setup:

   Semantic Model Structure:

   • Main dataset with multiple tables. SecurityDepartment table, Department table, Main table 
   • Bidirectional cross-filtering & Security enabled between SecurityDepartment & Department Table. 
     
    
   
   Any insights on proper RLS setup with workspace permissions would be greatly appreciated!

[sajit · Accepted solution]

hi @v-pgoloju , @GilbertQ 
Thanks for your responses, 
I was able to get the RLS working after updating the dataset-level permission from "Read" to "Build," while keeping the workspace-level access as "View only."
After this change, users were able to access the model from Excel, and the report visuals are now displaying correctly instead of appearing blank.

[Poojara_D12 · Accepted solution]

Hi @sajit 

Your issue where a user with Row-Level Security (RLS) assigned cannot see the semantic model in the workspace and gets blank visuals typically arises from a combination of workspace permissions and RLS role setup. Although you assigned the user as a Workspace Viewer, this role alone does not grant sufficient access to the underlying dataset or semantic model—it only lets them view reports and dashboards but not the dataset itself. For RLS to work properly, users must have at least Build permission on the dataset or be granted access through roles that allow dataset consumption with RLS filters applied.

Your RLS implementation using a security table(SecurityDepartment) with a DAX filter on USERPRINCIPALNAME()

 and correct relationships is the right approach. However, for users to see filtered data:

1. Workspace Permissions: Ensure users have Build or Member role in the workspace or are directly assigned permissions on the dataset. Viewer role restricts dataset visibility, which can cause blank visuals.

2. RLS Role Assignment: Assign the RLS role directly to users within the Power BI service dataset security settings, not just in the model.

3. Dataflow Inclusion: Since your security table is from a dataflow, verify the dataset refreshes properly to include latest security mappings.

4. Test with ‘View as Role’: Use the “View as Role” feature in Power BI Desktop or Service to confirm that the RLS filter behaves as expected for the user.

Correct RLS requires appropriate workspace or dataset permissions alongside the RLS role assignment. Giving users Viewer access only won’t allow them to see filtered data; they need Build permissions or higher to interact with the semantic model and see visuals populated by RLS. Adjusting these permissions and validating role assignments should resolve the blank visual issue.

[v-pgoloju]

Hi @sajit,

Great to hear that it's working as expected on your end! Could you please Post the solution and accept as solution? It would be really helpful for others in the community who might be facing similar issues and can address them quickly. Also, I would suggest accepting your approach as the solution so that it can benefit others as well.

Thank you & regards,
Prasanna Kumar

[sajit · Accepted solution]

hi @v-pgoloju , @GilbertQ 
Thanks for your responses, 
I was able to get the RLS working after updating the dataset-level permission from "Read" to "Build," while keeping the workspace-level access as "View only."
After this change, users were able to access the model from Excel, and the report visuals are now displaying correctly instead of appearing blank.

[v-pgoloju]

Hi @sajit,

Thank you for reaching out to the Microsoft Fabric Forum Community.
And also thanks to @GilbertQ  for Prompt and helpful response.

Just following up to see if the solution provided was helpful in resolving your issue. Please feel free to let us know if you need any further assistance.

If the response addressed your query, kindly mark it as Accepted Solution and click Yes if you found it helpful  this will benefit others in the community as well.

Best regards,

Prasanna Kumar

[GilbertQ]

Hi @sajit 

Can you please confirm that the user has got read level access to the semantic model?

[sajit]

Yes the user has read level access to the semantic model. 
A second user also has build access along with read.

[GilbertQ]

Hi @sajit 

If you're looking to use dynamic row level security, please look at this blog post from Kasper with regards on how to set it up, as this the way to set it up with the correct pattern.

Power BI Desktop Dynamic security cheat sheet - Kasper On BI