Row Level Security

[Kevdie11]

I created Roles within Power Bi Desktop. When I test them within Desktop they work as expected.

After I publish the report, I set up security as one should. When I "Test as Role", the RLS works as expected, but when I test as a user (the person is allocated to the role I mentioned above), then they can see all data. This seemed like it should work as simply as that, why is it not working? Also, when I ask the user to test, he advised that he can still see all data when he logs in.

I also added them as a "Viewer" to the Workspace.

Thank You

[v-yanjiang-msft]

Hi @Kevdie11 ,

Is your problem solved?? If so, Would you mind accept the helpful replies as solutions? Then we are able to close the thread. More people who have the same requirement will find the solution quickly and benefit here. Thank you.

Best Regards,
Community Support Team _ kalyj

[v-yanjiang-msft]

Hi @Kevdie11 ,

1. When select View as, if you want to enter the user name to test, you should checked the role name at the same time.

If you only checked the Other user, you will see all the data.

2. If the user can see all the data in Service, check if you have a group in the workspace member/contributor/admin, and the RLS user is in the group. In this way, RLS will be invalid and he will see all the data.

Best Regards,
Community Support Team _ kalyj

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[edhans]

I would have to see more to understand what exactly isn't working, but I would remove the user from the workspace entirely and only add them as a viewer to the App for the workspace. 

[Kevdie11]

So here is my data model.

All we basically did was create a role for every Salesperson, and then we want to link every Salesperson's Email address to the respective roles on Power Bi Online. I.e. They should only be able to see Sales data pertaining to them.

Let me give you an example:

I create a role for "Online" Salesperson

Here you can see the user's access to the workspace

Here you will see I have added Richard to the role

Here I am testing the role (Now viewing as: Online) You'll notice that I can only see data for Online.

But, when I change it to view as "Richard Stevens" (who is allocated to the Online Role ONLY), then I can see all data.

Thanks in advance

[edhans]

Get rid of both the Sales Person master and Customer Grouping master. Merge those into Customer master. Sales Person and Groupings are just additional attributes.

I am not sure what Customer Created is, but don't relate that to Sales Fact table. Never relate fact tables together.

Finally, get rid of the Bi-Di relationship between Customer Master and Sales Fact Table. Should be 1 to many.

You have model ambiguity. For example, Customer Master directly filters Customer Created. But It can also filter Sales Fact Table which in turn filters Customer Created. so there are two ways for data to get filtered and you cannot control what path the model uses. 

Then try RLS.