Row-Level Security Members Updating - Creative Solutions?

[kmes912]

Within Power Query, I am dynamically pulling users emails & access to "unit" based on the latest access that they have in another system. Set this to my master list of units, Many (Security) to One (Master List of Units) with cross filter both and apply security in both directions. 

It works when I test but was not working in the service for other users or behaving as expected.

I ended up publishing it to My Workspace to see if it was a matter of access. The users get the row level security error and are unable to see any visuals unless I add them to to the "Security" group within the web service. 

Anyone have creative solutions around maintaining this? I do not have Microsoft 365 Admin access in my company. Are there alternative dummy groups I can set up? Since the access is dynamic and lives within the PBIX file, I do not care who has access to the group so really I want every person possible in this "Security" group since it will filter out anyone through the actual row level in the report. But also want to keep this clean to not have to manually update this weekly/monthly/etc. Willing to test workspace, app access, but this seems like yet another that we have to update.

Is this just an admin task you have set to do every time you grant a user access to the app? 

[GilbertQ]

As @JR-DCPS suggested you need to add in an AD Security Group with all the users so you dont have to manage it on an individual basis.

[GilbertQ]

Hi @kmes912 

can you confirm that your RLS setup is working as expected when you tested it?

If it does work, then you will need to add all the users to the Role in the Power BI Service to allow them to view what they need to see.

Here is a good example to make sure your RLS is set up corretly. Power BI Desktop Dynamic security cheat sheet - Kasper On BI

[kmes912]

HI @GilbertQ  yes it works properly when I test as role. But if I do not manually add the user in the Power BI Web Service under the "Row Level Security" Security manually one by one, they cannot see anything. It just shows a blank screen saying Row Level Security has been applied. I'd like to add everyone in my organization, then let the actual dynamic row level security dictate it but cannot figure out how to without manually adding everyone to "Security"

[JR-DCPS]

Does your company have an "All employees" Active Directory group, or something of the like? I use groups exclusively so I don't have to manage individuals across multiple reports.

The reason it works on Desktop because you directly feed PBI the security information. PBI Service needs to know who belongs in each security group so it knows what rules to apply to each individual. It's not going to read your security table directly.