Row Level Security (RLS) - Can I use this to restrict data for builders or just viewers?

Hello SarahHope ,

1. Publish your semantic model to a central workspace, say Workspace A.
2. Use roles with filters like: [Region] = USERPRINCIPALNAME(),
Assign users or security groups to these roles in Power BI Service → Dataset → Security.
3. Give “Build” Permission on the Dataset (Not the Workspace!)
-Go to Workspace A → Datasets → More options (⋯) → Manage permissions
-Give the users or their security group “Build” permission
-This allows them to build reports using the dataset but does not override RLS
4. In Workspace A, assign the users the Viewer role only
Viewer role + Build permission = Report creation + RLS respected
5. Create Reports in Other Workspaces
In Workspace B, your user can go to “Get data → Power BI Datasets”
They select the centralized dataset from Workspace A
They build reports in Workspace B — RLS is enforced automatically (because they’re not elevated in Workspace A)
6.Share reports via apps or workspace permissions
Again, ensure consumers in Workspace B also follow the Viewer + Build model if they’ll connect directly to the dataset

Notes:
-Do NOT give users Contributor or Member roles in Workspace A — this bypasses RLS
-Test RLS in Power BI Service by using “Test as role” in dataset security, not just “View as” in Desktop
-Use Azure AD groups where possible for easier RLS and permission management

If this solved your issue, please mark it as the accepted solution. ✅

Hi SarahHope 

Row Level Security (RLS) in Power BI is primarily designed to restrict viewing of data, not building or editing permissions. In your case, you're correctly trying to use RLS to allow users to self-serve reports while seeing only the data they are allowed to access, based on a centralized dataset. However, in Power BI Service, users who have "Build" permissions can create their own reports based on the dataset but still respect the RLS rules you set as long as they only have "Viewer" or "Build" access and not elevated workspace roles like "Contributor," which override RLS and grant full data access.

Your issue arises because workspace roles like "Contributor" inherently bypass RLS restrictions. To accomplish your goal, make sure users only have "Viewer" role at the workspace level and "Build" permission on the dataset separately through Manage Permissions, not by promoting their workspace role.

This setup lets them build reports from the dataset (using "Get data" > "Power BI datasets") while still being restricted by RLS when they view or interact with the data. You're very close  it's just about balancing the right permissions between workspace role and dataset access.