Forum Discussion
Updating RLS Security in Service when publishing
Hey ZR3036 ,
unfortunately, what you are looking for is not possible. In Power BI Desktop you define the rules for the roles (the DAX statement), even if you have a table of users (the email address, or being more precise - the userprincipalname). it's not possible. You can not use Power BI Desktop to alter the membership of the roles.
I recommend using Azure Active Directory security groups (now known as Azure Entra ID security groups), add these security groups to the roles instead of individuals. Still you need to figure out how to properly assign the individuals to the security groups.
Please be aware that Row Level Security does not apply if the workspace is same that hosts the semantic model and also hosts the members, the only exception, meaning RLS will be honored is the situation when the members have the Viewer workspace role assigned.
It's always a good practic to share Power BI apps among users instead of adding users to the workspace.Hopefully, this helps to tackle your challenge.
Regards,
Tom
Hey ZR3036 ,
unfortunately, what you are looking for is not possible. In Power BI Desktop you define the rules for the roles (the DAX statement), even if you have a table of users (the email address, or being more precise - the userprincipalname). it's not possible. You can not use Power BI Desktop to alter the membership of the roles.
I recommend using Azure Active Directory security groups (now known as Azure Entra ID security groups), add these security groups to the roles instead of individuals. Still you need to figure out how to properly assign the individuals to the security groups.
Please be aware that Row Level Security does not apply if the workspace is same that hosts the semantic model and also hosts the members, the only exception, meaning RLS will be honored is the situation when the members have the Viewer workspace role assigned.
It's always a good practic to share Power BI apps among users instead of adding users to the workspace.
Hopefully, this helps to tackle your challenge.
Regards,
Tom
Thank you for the reply, Tom.
Using Azure Entra ID Security Groups is what I'm looking at doing currently, it makes sense Desktop could not alter roles in Service in a workspace. Would that make the roles table I have in the report pointless since I already restricted data views with Manage Role rules in PBI Desktop?