Restricting User Access

[DJSAM]

I have a workspace setup with an existing report, all users (except the admins) are set to have read acess within the workspace and then I have RLS setup to split the users so they only see data for their respective countries. I now wish to add a new dataset / report and this time I want to ensure only some users in the workspace can see the data on this new dataset. I can't see any way to manage permissions on a per dataset basis (outside of RLS). Under MyNewDataset > Manage Permissions I see a list of all the users on the workspace. All the tickboxes are unchecked (except admins who are dark grey) and I'm not entirely sure what the point of them is as I can't see any buttons that could be tied to the list / tickbox status. I was hoping for some option where I could tick users and remove their access to the dataset.

That being the case I added an RLS group with all tables set to false in the desktop app and added all the users who shouldn't have acess to the dataset to it under MyNewDataset > Security. I did initially try to just add one RLS group with no restrictions in the hope that users not assigned to it wouldn't be able to view the dataset (I've read this is how it behaves for other users on this forum) but when testing a user not within this one RLS group was able to see the data in the report. 

Is there any better way of doing this without creating a new workspace and if not is there any way to either default users to an RLS group or set it so they have no access if not assigned to a group?

Many thanks in advance.

[v-robertq-msft · Accepted solution]

Hi, @DJSAM 

In my opinion, the RLS is designed for making the viewers of this report restricted by their role. If you give them the view permission and don’t give them a role in RLS, they can see all the data without restriction. You can keep in mind: the RLS only works for the viewers of the report who don’t have “Build permission” to the underlined dataset. If the end-users get “Build permission” to the dataset, RLS can’t work on them anymore.

Add all the users you want to invite to a Security group and add this group to the RLS role may meet your requirement. You can check this video:

https://guyinacube.com/2020/02/25/can-you-use-groups-with-power-bi-row-level-security-rls/

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[DJSAM]

Thank you for the response. As you mentioned it turned out the user we got to test it actually had contributer permissions and this is why, despite them not being in the RLS group we setup, they could still access the dataset. So basically me being stupid 🙂 I didn't realise you could use security groups with RLS as well, that could be very helpful in the future, thanks for the video.

[darentengmfs]

@DJSAM 

I think you should not add them to the workspace. You should instead share the reports to the people that should have restricted data. I believe if you add people to workspaces, they have full access to data, regardless of setting up RLS.

[DJSAM]

Thanks, as mentioned in the response above if the users have the right permission level (just viewer) they will not be able to access the dataset if an RLS group has been created and they're not assigned to it. I just made a mistake in not realising that the user who tested it had contributor permissions.