Solved: Sudoing as a User using Dynamic RLS

Anonymous · ‎06-08-2020

Hi,

I've created a data model which contains dynamic RLS using USERPRINCIPALNAME()

I can then sudo as a user within the model using "View As" and the RLS works as intended.

However what I haven't been able to work out how to do is sudo as one of our users within Power BI service so that I can see what they would see when viewing the reports that we have built off of the model.

When I attempt to use "Test as Role" in Service to sudo as a user I'm running into two problems

1) If I test as the role "Security" I can't see any data. (I assume becaue there is no info in the model in my name)

2) When I try to test as a user (for whom the RLS works in the model on desktop) I can't seem to simaltaneously also test them as part of the RLS (even though they are saved as part of the "Security" RLS group in Service), meaning that I see everything in the report.

Is there a way to get around this so that I can view my report as a user who is part of an RLS group would see it in Service?

Thanks!

v-lili6-msft · ‎06-09-2020

hi @Anonymous

Dynamic RLS (USERPRINCIPALNAME()) is not supported "Test as Role" in power bi service, you could test it in power bi desktop.

When I attempt to use "Test as Role" in Service to sudo as a user I'm running into two problems

1) If I test as the role "Security" I can't see any data. (I assume becaue there is no info in the model in my name)

yes, becaue there is no info in the model in my name.

2) When I try to test as a user (for whom the RLS works in the model on desktop) I can't seem to simaltaneously also test them as part of the RLS (even though they are saved as part of the "Security" RLS group in Service), meaning that I see everything in the report.

That because USERPRINCIPALNAME() still return your name.

You could do it in power bi desktop select BOTH the role that you want to test AND the "Other User" role and then specify the user you want to impersonate on the desktop .

Regards,

Lin

Community Support Team _ Lin
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

View solution in original post

v-lili6-msft · ‎06-09-2020

hi @Anonymous

Dynamic RLS (USERPRINCIPALNAME()) is not supported "Test as Role" in power bi service, you could test it in power bi desktop.

When I attempt to use "Test as Role" in Service to sudo as a user I'm running into two problems

1) If I test as the role "Security" I can't see any data. (I assume becaue there is no info in the model in my name)

yes, becaue there is no info in the model in my name.

2) When I try to test as a user (for whom the RLS works in the model on desktop) I can't seem to simaltaneously also test them as part of the RLS (even though they are saved as part of the "Security" RLS group in Service), meaning that I see everything in the report.

That because USERPRINCIPALNAME() still return your name.

You could do it in power bi desktop select BOTH the role that you want to test AND the "Other User" role and then specify the user you want to impersonate on the desktop .

Regards,

Lin

Community Support Team _ Lin
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

lbendlin · ‎06-08-2020

You are missing one step of the desktop testing process. You need to select BOTH the role that you want to test AND the "Other User" role and then specify the user you want to impersonate on the desktop .

You'll likely find that some of your rules need adjustments.