User in multiple security groups

[kristenmcnelly]

Hello! I have a user that is in 2 security groups. The first security group they are a part of due to being on a distribution list. This security group allows users on the distribution list to see data about people in a specific market. In this case, it would allow the user to see people in Tampa. The second security group they are a part of using their email. This security group allows the user to see people in Tampa + a few other specific employee IDs (not in Tampa). The user is reporting that they can only see people in Tampa. How can I have the second security group override the first one? Thank you!

[lbendlin]

Usually this is automatic. More permissive rule overrule more restrictive rules. There must be something else going on. Check your RLS rules.

[kristenmcnelly]

The first security group rule is [User Information List.UserName] = USERPRINCIPALNAME() and the second security group rule is [Region] = "Tampa" || [Employee ID] = x... They use different tables. The first one is using SharePoint and the second one is using a PBI dataflow. Does this give you any clues as to what might be wrong?

[lbendlin]

"[Employee ID]=x"  - please elaborate.  At what point is that joined to USERPRINCIPALNAME and how? Are you trying to combine static and dynamic RLS?

[kristenmcnelly]

x is the Employee ID number. It is not joined to USERPRINCIPLENAME. The first security group is dynamic, while the second security group is static. In this case, I want the static security group to be used, not the dynamic one.

[lbendlin]

oh boy.  Are the RLS rules impacting the same dimension table?

[kristenmcnelly]

Oh boy haha. Yes. The second security group was set up as a test to see if I could add more access to the first security group for a specific person.

[lbendlin]

you can, technically. As I said, more permissive rules override more restrictive rules. But you're making the setup more complex than you may want to maintain later.