Row Level Security Issues

[justingraff88]

I have a report which the RLS was working great. I went on PTO for two weeks and i think some permissions got changed on the workspace. I've updated everything back to what it was (everyone has viewer access except for a couple admins) but now my RLS is behaving strangly. It is dynamic for some users using userprincipalname() to filter based on their AD login. I have two roles: one that can see all with no filters, and one that uses the dynamic filter. How it was working before was the users assigned to the role with no filters could see everything, the users assigned to the dynamic role would only see entries assigned to them and if anyone else who had access to the workspace but was not in any of the roles tried to view the report the visuals would error out.

Now it half of the users in the dynamic role it works for and the other half is able to see everything. Also users who have access to the workspace but are not assigned a role are also able to see everything. I feel like there is some additional owner permissions granted somewhere but I have checked the permissions to the workspace and the individual report and both have everyone set to viewer. Any help would be great.

[v-luwang-msft]

Hi @justingraff88 ,

Has your problem been solved, if so, please consider Accept a correct reply as the solution or share your own solution to help others find it.

Best Regards
Lucien

[v-luwang-msft]

Hi @justingraff88 ,

You can create a new workspace, then try to publish the report to this new workspace, then take the viewer that was previously only a viewer but had access to all the data, configure it as a viewer in the new workspace, and use that account to access the report in the new workspace to see if you can access all the data. If you can see the data, then go check the configuration of rls in the Pbix file, and if you can't see the data, go verify the role permissions in that worksapce before.

Did I answer your question? Mark my post as a solution!

Best Regards

Lucien

[GilbertQ]

Hi @justingraff88 

Can you also use SSMS and connect to the dataset if using PPU or Premium and then see when those users log in what they are shown as and what they are mapped to?

As @Tutu_in_YYC says it must be another permission which has got elevated permissions.

[Tutu_in_YYC]

Hi Justin,

The only way to bypass RLS is through Workspace role. But if you have assigned everybody (but Admin) Viewer, then you have set it up correctly. Can you check if there is a AD Security Group in your workspace that may have Member or higher role? AD Security Group may contain more users, and the role will overwrite the same person that is already assigned with Viewer. 

---

@justingraff88 wrote:

... Also users who have access to the workspace but are not assigned a role are also able to see everything.

---

This is odd. Try publishing a dummy report with RLS to test it out?