Forum Discussion
Helper IIRole Security in a Model - Mix depending on workspace/report
Impactful IndividualHi omacoder
If i'm understanding well, you have a model and from that model you want to have different reports, ones with RLS and others with no RLS.
Something that you can do is to create one general report with the general model with all the measures necessariess and then you can create 2 reports that take the dataset from this general model (upload the general model to the powerbiservice and connect to that model in the 2 reports), one report you can create the sheets with details and RLS and the other with General info without RLS.
Then if it is more easy for you, you can create in your azure (if you have) a distribution list (thhat it is more ease to manage who can access to the report) and then share as readers the report to the distribution list.
The people as readers will be affected by the RLS and the admins or editors in the workspace (normally should be internal people of your company) will not be affected to the RLS.
Helper IIAnonymous , I'm not going to maintain two exact copies of the same very detailed model. This is a developers nightmare.
dobregon yes, you are understanding. We have one large very complex model. That model has roles defined for RLS. The model is published to the service and the model contains ZERO reports.
Developers and report writers then create reports off of this model, all in Service. Utilizing the shared and certified model / dataset. Some of these reports that get created NEED to have the RLS applied. However, some of these reports also need to BYPASS the RLS because these are regional managers who need to see 100% of the content. I'm not clear on your proposal on how we would implement this?
omacoder RLS is an all or nothing deal. The "contributer" exception is the only bypass, which is done for the necessity of development.
Creating a superuser role is the best work around here, which is generally what i do with Azure SSAS models where RLS is enforced. In Azure i can add Active Directory Security Groups to the role, which helps me manage access. I've not tried using these groups in RLS specifically, but they do work in Workspace and App permissions, so i'd have some confidence it could work in there too.