Row Level Security (RLS) - Can I use this to restrict data for builders or just viewers?

[SarahHope]

My goal here is to be able to publish the same samantic model (dataset) to more than one workspace, but use RLS so that the users in each workspace can only see what they are allowed to see.  This will enable me to reuse datasets, rather than have to restrict them individually at the SQL level for each data source.

•  Publish a centralized dataset
• Let people self-serve and build reports
• Restrict what data they can see and use

I have it working on the destkop side as far as testing with "view as", but it is not working on the Power BI Service (web) side.

I have

• View level permissions at the workspace level (because I understand that Contributor is elevated and will override RLS)
• Build level permissions on the dataset/semantic model
• Added user to the RLS Security setting in the semantic model/dataset

My user can only see reports in the Workspace and not the semantic model that I gave her build access to.

If I give her contributor on the workspace, she can see ALL the data, not just hers.

Having her use power bi desktop is not an option.

Is there any way to accomplish what I want to do or is RLS just to control viewing of data?

Thanks!  
Sarah

[anilelmastasi · Accepted solution]

Hello @SarahHope ,

1. Publish your semantic model to a central workspace, say Workspace A.
2. Use roles with filters like: [Region] = USERPRINCIPALNAME(),
Assign users or security groups to these roles in Power BI Service → Dataset → Security.
3. Give “Build” Permission on the Dataset (Not the Workspace!)
-Go to Workspace A → Datasets → More options (⋯) → Manage permissions
-Give the users or their security group “Build” permission
-This allows them to build reports using the dataset but does not override RLS
4. In Workspace A, assign the users the Viewer role only
Viewer role + Build permission = Report creation + RLS respected
5. Create Reports in Other Workspaces
In Workspace B, your user can go to “Get data → Power BI Datasets”
They select the centralized dataset from Workspace A
They build reports in Workspace B — RLS is enforced automatically (because they’re not elevated in Workspace A)
6.Share reports via apps or workspace permissions
Again, ensure consumers in Workspace B also follow the Viewer + Build model if they’ll connect directly to the dataset

Notes:
-Do NOT give users Contributor or Member roles in Workspace A — this bypasses RLS
-Test RLS in Power BI Service by using “Test as role” in dataset security, not just “View as” in Desktop
-Use Azure AD groups where possible for easier RLS and permission management

If this solved your issue, please mark it as the accepted solution. ✅

[v-venuppu]

Hi @SarahHope ,

I hope this information is helpful. Please let me know if you have any further questions or if you'd like to discuss this further. If this answers your question, please accept it as a solution and give it a 'Kudos' so other community members with similar problems can find a solution faster.

Thank you.

[v-venuppu]

Hi @SarahHope ,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[v-venuppu]

Hi @SarahHope ,

Thank you @rohit1991 @Tutu_in_YYC @anilelmastasi for the prompt response.

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[rohit1991 · Accepted solution]

Hi @SarahHope ,
Row Level Security (RLS) in Power BI is primarily designed to restrict viewing of data, not building or editing permissions. In your case, you're correctly trying to use RLS to allow users to self-serve reports while seeing only the data they are allowed to access, based on a centralized dataset. However, in Power BI Service, users who have "Build" permissions can create their own reports based on the dataset but still respect the RLS rules you set — as long as they only have "Viewer" or "Build" access and not elevated workspace roles like "Contributor," which override RLS and grant full data access.

Your issue arises because workspace roles like "Contributor" inherently bypass RLS restrictions. To accomplish your goal, make sure users only have "Viewer" role at the workspace level and "Build" permission on the dataset separately through Manage Permissions, not by promoting their workspace role.

This setup lets them build reports from the dataset (using "Get data" > "Power BI datasets") while still being restricted by RLS when they view or interact with the data. You're very close — it's just about balancing the right permissions between workspace role and dataset access.

Passionate about leveraging data analytics to drive strategic decision-making and foster business growth.

Connect with me on LinkedIn: Rohit Kumar.

[Tutu_in_YYC]

Can you let us know how you are setting the RLS? The DAX statement.

[anilelmastasi · Accepted solution]

Hello @SarahHope ,

1. Publish your semantic model to a central workspace, say Workspace A.
2. Use roles with filters like: [Region] = USERPRINCIPALNAME(),
Assign users or security groups to these roles in Power BI Service → Dataset → Security.
3. Give “Build” Permission on the Dataset (Not the Workspace!)
-Go to Workspace A → Datasets → More options (⋯) → Manage permissions
-Give the users or their security group “Build” permission
-This allows them to build reports using the dataset but does not override RLS
4. In Workspace A, assign the users the Viewer role only
Viewer role + Build permission = Report creation + RLS respected
5. Create Reports in Other Workspaces
In Workspace B, your user can go to “Get data → Power BI Datasets”
They select the centralized dataset from Workspace A
They build reports in Workspace B — RLS is enforced automatically (because they’re not elevated in Workspace A)
6.Share reports via apps or workspace permissions
Again, ensure consumers in Workspace B also follow the Viewer + Build model if they’ll connect directly to the dataset

Notes:
-Do NOT give users Contributor or Member roles in Workspace A — this bypasses RLS
-Test RLS in Power BI Service by using “Test as role” in dataset security, not just “View as” in Desktop
-Use Azure AD groups where possible for easier RLS and permission management

If this solved your issue, please mark it as the accepted solution. ✅

[Lamasta]

They can't see semantic models as viewers how do they build ?

[Tutu_in_YYC]

They can still access the semantic model through power bi desktop or the onelake catalog.