Role Could Not Be Updated - RLS

[aricks]

Hi,

I am attempting to re-add an external user to some Power BI reports. When attempting to re-add them to the row-level security, I run into this error:

All the other users I re-added worked fine, but this one is stuck with the error. Any ideas?

[v-dineshya · Accepted solution]

Hi @aricks ,

Thank you for reaching out to the Microsoft Community Forum.

Please check below things to fix the issue.

1. Please check the external user is still part of your Azure Active Directory (AAD) tenant.

2. Confirm that the external user has access to the workspace where the dataset resides. They must have at least Viewer access to be added to RLS.

3. Sometimes cached permissions cause issues. Try removing the user completely and re-inviting them.

4. Try updating the RLS roles using Power BI Desktop and re-publish the dataset.

5. And also check for Special Characters or Formatting Issues, check the username/email is correctly formatted and doesn’t contain hidden characters.

If this information is helpful, please “Accept it as a solution” and give a "kudos" to assist other community members in resolving similar issues more efficiently.
Thank you.

[aricks]

Hello v-dineshya, thank you for the assistance.

1. We checked that the external user was still in the AAD tenant.

2. The user was added to the workspace with viewer access, we attempted removing and re-adding as well.

3. We've removed the user and completely deleted them everywhere to attempt to re-invite, checked their email for correct format, etc. Once we completed this and attempted to add them to RLS, the error remained.

Unfortunately, the error persists. Any other ideas?

[v-dineshya]

Hi @aricks ,

Please check below things to fix the issue.

1. Please try to re-publishing the report from Power BI Desktop and then re-adding the external user to the RLS role. This refreshes the dataset and resets the security bindings.

2. check Azure Active Directory settings allow guest users to be added to roles. Sometimes, tenant-level restrictions prevent external users from being assigned to RLS roles even if they appear in the directory.

3. Ask the external user to accept the invite first. If they haven’t accepted it, you can’t add them to the role.
Wait for a few minutes after they accept. Sometimes it takes time to fully add them to the system.

4. Only certain admin roles can assign users to RLS roles. Confirm that your account has the necessary permissions in both Power BI and Azure AD.

If this information is helpful, please “Accept it as a solution” and give a "kudos" to assist other community members in resolving similar issues more efficiently.
Thank you.

[aricks]

Hello,

Thank you for the new steps to attempt to use. I attempted to add the user again this morning before attempting any other troubleshooting steps (roughly 2 days after the initial error) and it allowed me to add the account to RLS. It seems to have resolved itself after waiting for some time.

We're unsure if the other steps to try and resolve the issue the day before expedited this process, but the error has subsided. Thank you for the help.

[GilbertQ]

Hi @aricks 

Can you please confirm that the external user you're trying to add is a guest user account in your tenant?