Forum Discussion
Row Level Security Changed? Implementation in Workspace vs App Workspace
In a workspace, Row Level Security (RLS) is only applied to users with the "Viewer" role. Other workspace members with the "admin", "member" or "contributor" role are not subject to RLS and see the whole data. Anyone consuming reports through an App are subject to RLS. This has been the case since June 2019.
Hope this helps
Stuart
Hi Burningsuit
the documentation you referenced does not mention APP access explicity, it only talks about Workspaces. This documentation https://learn.microsoft.com/en-us/power-bi/guidance/rls-guidance does mention APPS and says
When a specific user can see all data, it's possible they're accessing reports directly in the workspace and they're the dataset owner. RLS is only enforced when:
- The report is opened in an app.
- The report is opened in a workspace, and the user is mapped to the Viewer role.
But that is NOT the experienced behaviour. RLS for workspaces owners is NOT applied in the APP, as per your testing and my own testing. Is this a bug?
Best Wishes
Andrew Dale
It amuses me how this topic lingers on.
No, I don't think it is a bug. The documentation may be at fault for not explicitly explaining every possible scenario, but two minutes experimentation (and some thought) explains what is going on very clearly.
RSL is applied in an App if the App users are not Admin, Members or Contributors in the Workspace the App is built from.
To me this makes perfect sense. Why apply RLS in an App, when the Admin, Members or Contributors in the Workspace can simply go to the Workspace and see all the data ?
Some basic thought here explains what's going on.
1) Power BI separates Data (Datasets) from Visualisations (Reports)
2) Permissions are applied to a Dataset
3) Building an App from a Workspace copies the Visualisations (Reports) into the App and connects them back to the Data (Datasets) in the Workspace.
3) If an Admin, Member or Contributor can see all data in the Workspace, they can see all data in the App. Because there is only one location of the Data and Permissions are applied on that Data.
As a footnote to all this, in my nearly 50 years in Computing and IT I have found that when the Documentation contradicts your real-world experience it is nearly always the documentation that is wrong!
Hope this helps
Stuart
RE: Why apply RLS in an App, when the Admin, Members or Contributors in the Workspace can simply go to the Workspace and see all the data?
Just because the admin/contributor can switch back to the workspace if they want to see all of the data is not justification for having the RLS of the app behave differently. For the Microsoft's and Facebook's of the world where the roles are clearly defined and separated, that makes perfect sense. But that doesn't fit the small businesses of the world. When the admin/member/contributer is also a consumer, their experience in an app should be the same as everyone else in the app. First example is testing. If RLS worked the same in a deployed app for everyone who has access, then the functionality could be tested by the contributor. Otherwise I find myself asking a non-contributor for their username, password, and 2FA just so I can test that the RLS at the app level is working as expected. In all of my years working at the database level and handling RLS, I don't get to go into the business view and see all data just because I also happen to be a developer.
