What if a user is common in dynamic RLS report across two roles

[Rajnish366]

Q 1. In my Dynamic RLS PBI report few users are common across two roles (being part of two different group added in Role 1 and Role 2 as super user) what will happen in this case. which role will be effective? 

Q 2. Pls suggest the impact of Bi-directional (security applied at both side) many to one relation in a Dynamic RLS reoprt.

[Alatha]

Hi, I don't see any solution here. Please assist me on same scenario.
I also have same scenario where user is part of two roles .

I have one report and it has two personas site owners ans service owners.
And created 2 roless
site owners - rls applied
Service owners - no filters
as I have single report and it has home page with 2 buttons visit site owner view & visit service owners view and based on the  page navigations
now scenario 1. - when site owners access the report should see site owners button and should able to see the sites they own.
scenario -2 - when service owner access the report should see both buttons and when clicks on service owners should see all sites and clicks on site owners should see only owned sites.
working as expected -Site owners access able to see only single button and also see the sites they own
problem - when service owner access the report and able to see both buttons and clicks on service owners button able to see all sites BUT when clicks on site owners button also seeing all sites instead of sites they own.
please assist me to achieve this as expected

[GilbertQ]

Hi @Rajnish366 

Power BI uses the niece restrictive security model. So what that means is if a user belongs to two roles, but we'll get a combination of access to both of those RLS Roles which could lead to the user seeing more data than what they should see. With regards to question two using the bidirectional work as expected only when using row level security.

[v-aatheeque]

Hi @Rajnish366 

 We haven’t heard from you on the last response and was just checking If the answer posted  by @GilbertQ  was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!

[Rajnish366]

Hi @GilbertQ,

In my model i have created two role 1. Email = Userprinciplename ()  2. Super users where dax is only True ().
Few users are part common member of AD groups which i added in both  roles. 
My question is which role will dominate here in this case. 
Thanks for your time.

[v-aatheeque · Accepted solution]

Hi @Rajnish366 
Thanks for reaching out to Microsoft Fabric Community Forum.

1.This is likely a role based on the UserPrincipalName() DAX function, which is commonly used to assign permissions to users based on their email addresses or usernames.
2.This role is based on a condition where a DAX expression evaluates to True() for users who meet a specific condition (in this case, users who belong to certain Active Directory groups).

3.when multiple roles are assigned to a user, the most restrictive role generally takes precedence.

• If both roles apply to a user, the system will apply both sets of filters together unless there's an explicit conflict (such as one role restricting a value while another allows it).
• If the "Super Users" role is set up with broader access (e.g., True() condition for certain users), it may override or provide broader access than the "Email" role, depending on the conditions of the "Email" role.

Addtionally For  the UserprincipalName() function, you can refer to :
DAX USERPRINCIPALNAME - Use in RLS - Power BI Docs

And for how dynamic rls sample model , you can refer to :
Dynamic Row Level Security with Power BI Made Simple - RADACAD

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!