Unable to test RLS 'Test as Role' for external users in Power BI service

[PGhosh]

Hi everyone, 

I used to test Row level security in Power BI service using "Test as role" feature under Security. However, now it has stopped working using standard email address format. 

We are storing email ID's in a RLS table. In the past standard email ID's used to work, however now I am seeing some string is getting added to the actual email address. E.g. - xyz.bodo_businessmail.com#EXT#@companyname.onmicrosoft.com . (Displaying in the report using UserPrincipalName()). 

To test,  I stored this above string of email ID in RLS table, and 'Test as role' starts working in Power BI service. I did not have to do this in the past. 

Wondering if anyone else is experiencing this issue?  What changed recently and how we can continue to use standard email ID's for RLS in Power BI?  

Thanks in advance for your help. 

@powerbiservices @PowerBI 

[LucaDC]

@powerbiservice I'm experincing the same issue. Have you provided or suggest any solution ? Thanks

[PGhosh]

@Anonymous - Looks like you accepted the solution provided by @v-henryk-mstf . 
Can you please explain how its helping you fix the testing issue? 

[v-henryk-mstf]

Hi @PGhosh ,

According to your description, the format of the above emails indicates that external guest users are invited in your tenant and they are applied to RLS. their email address format will be distinguished by adding #EXT#. You can see the email addresses of all members of your organization including guest users in Microsoft 365 admin center->Active users.

Alternatively, dynamic RLS is available for internal or guest users, and can be implemented with the USERNAME() and USERPRINCIPALNAME() functions, which return a result showing the guest user's email address.

For more details, you can read related document link.

Distribute Power BI content to external guest users using Azure Active Directory B2B - Power BI | Mi...

If the problem is still not resolved, please provide detailed error information and related operation screenshoots. Looking forward to your reply.

Best Regards,
Henry

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[PGhosh]

hi @v-henryk-mstf  

Thanks for your response. I am using USERPRINCIPALNAME() for RLS. 

My Question is different – If I am storing email ID’s in standard format ( Without #EXT#) I am unable to Test security in Power BI service ( Via – Test as role).

Now to test security of my dataset in Power BI service, I have to store the email format, eg.  xyz.bodo_businessmail.com#EXT#@companyname.onmicrosoft.com in RLS table.

I never had to do this before. 

Now when I am testing RLS, it always shows blank charts in PBI Service. I tested it for the external users you can access this report fine and see their data on our tenant. Screenshot below. 

[Anonymous]

Hi PGhosh,

Did you solve this one?

Because we are experiencing the same thing. We cannot test as role unless we add the email format with #EXT#.

[PGhosh]

Hi @Anonymous - No the issue is not solved yet. I am not really sure who accepted @v-henryk-mstf response as a solution. 

I did respond to @v-henryk-mstf's response with more information and screenshots but havent heard back. 
This issue still persists and so far I have not found any solution. 

Thanks!