Forum Discussion
Row Level Security Changed? Implementation in Workspace vs App Workspace
In a workspace, Row Level Security (RLS) is only applied to users with the "Viewer" role. Other workspace members with the "admin", "member" or "contributor" role are not subject to RLS and see the whole data. Anyone consuming reports through an App are subject to RLS. This has been the case since June 2019.
Hope this helps
Stuart
In a workspace, Row Level Security (RLS) is only applied to users with the "Viewer" role. Other workspace members with the "admin", "member" or "contributor" role are not subject to RLS and see the whole data. Anyone consuming reports through an App are subject to RLS. This has been the case since June 2019.
Hope this helps
Stuart
Burningsuit I had to unmark your answer as the solution. Based upon that information you provided, I submitted a defect to Microsoft Support as that is not the behavior we were seeing.
This was their response:
"We would like to inform you that the RLS works on the dataset so even if you have given contributor role to users for a workspace, it will be override and RLS will be implemented.Thanks & Regards,
Ravi Kumar| Support Engineer | Microsoft Business Intelligence"
Therefore it would seem, RLS has changed within the past year.
Thanks for this, it's very interesting as the Support Engineer seems to contradict the documentation (dated 13 April 2021 here Row-level security (RLS) with Power BI - Power BI | Microsoft Docs)
which says...
"If you publish your Power BI Desktop report to a new workspace experience in the Power BI service, the RLS roles are applied to members who are assigned to the Viewer role in the workspace. Even if Viewers are given Build permissions to the dataset, RLS still applies. For example, if Viewers with Build permissions use Analyze in Excel, their view of the data will be protected by RLS. Workspace members assigned Admin, Member, or Contributor have edit permission for the dataset and, therefore, RLS doesn’t apply to them. If you want RLS to apply to people in a workspace, you can only assign them the Viewer role. Read more about roles in the new workspaces."
It's clear he must be talking about the New Workspaces as the "Contributor" role did not exist in the "classic" workspaces. (They only had "members")
Intrigued with this I ran a little test.
1) Created a new Workspace "RLSTEST"
2) Published a dataset with RSL security in it to RLSTEST
3) Assigned RLS roles to users A B and C.
4) Assigned Workspace access as follows .. A is "Member" , B is "Contributor", C is "Viewer".
5) Viewed Report in Workspace RLS as A - No RLS applied
6) Viewed Report in Workspace RSL as B - No RLS applied (This contradicts your Engineer above)
7) Viewed Report in Workspace RLS as C - RLS applied
OK, so much for Workspace access, what about an App ?
1) Created an App from Workspace RLS, shared with A, B and C
2) Viewed App as A - No RLS applied
3) Viewed App as B - No RLS applied (Again this contradicts your Engineer)
4) Viewed App as C - RLS applied
As I understand it this is because of the access A and B have to the Workspace and the "Build" rights they have there. The Workspace access and "Build" rights override RLS.
This can be proved by Removing A B and C from the Workspace.
Then they can only see the App, Viewing the App gives the following result.
A gets RLS
B gets RLS
C gets RLS
I believe this is because they no longer have "Build" rights on the Dataset in the Workspace (They don't have any access to the Workspace at all), hence RLS is applied.
I freely admin that I am always learning with Power BI, and I'd really like to know if your experience is the same as mine, or what you're doing differently. I'd also like to know what your Support Engineer has to say in this instance. Maybe I'm doing it wrong and have misunderstood ?
Stuart
well detailed scenarios I would love that someone with more experience confirm this?
Thank you
Burningsuit please what do you mean by " Anyone consuming reports through an App are subject to RLS. This has been the case since June 2019" If we pass through Apps in Power Bi service the RLS will be applied to Contibutors and Members ?
To clarify, anyone consuming reports through an App, that are not Admin, Members or Contributors to the App's Workpace, are subject to RLS in that App.
Being an Admin, Member or Contributor to the Workspace will remove RLS, no matter how you consume the content (App, Shared Reports etc. ).
Hope this helps
Stuart
