What if a user is common in dynamic RLS report across two roles

[Rajnish366]

Q 1. In my Dynamic RLS PBI report few users are common across two roles (being part of two different group added in Role 1 and Role 2 as super user) what will happen in this case. which role will be effective? 

Q 2. Pls suggest the impact of Bi-directional (security applied at both side) many to one relation in a Dynamic RLS reoprt.

[GilbertQ]

Hi @Rajnish366 

Power BI uses the niece restrictive security model. So what that means is if a user belongs to two roles, but we'll get a combination of access to both of those RLS Roles which could lead to the user seeing more data than what they should see. With regards to question two using the bidirectional work as expected only when using row level security.

[v-aatheeque]

Hi @Rajnish366 

 We haven’t heard from you on the last response and was just checking If the answer posted  by @GilbertQ  was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!

[Rajnish366]

Hi @GilbertQ,

In my model i have created two role 1. Email = Userprinciplename ()  2. Super users where dax is only True ().
Few users are part common member of AD groups which i added in both  roles. 
My question is which role will dominate here in this case. 
Thanks for your time.

[v-aatheeque · Accepted solution]

Hi @Rajnish366 
Thanks for reaching out to Microsoft Fabric Community Forum.

1.This is likely a role based on the UserPrincipalName() DAX function, which is commonly used to assign permissions to users based on their email addresses or usernames.
2.This role is based on a condition where a DAX expression evaluates to True() for users who meet a specific condition (in this case, users who belong to certain Active Directory groups).

3.when multiple roles are assigned to a user, the most restrictive role generally takes precedence.

• If both roles apply to a user, the system will apply both sets of filters together unless there's an explicit conflict (such as one role restricting a value while another allows it).
• If the "Super Users" role is set up with broader access (e.g., True() condition for certain users), it may override or provide broader access than the "Email" role, depending on the conditions of the "Email" role.

Addtionally For  the UserprincipalName() function, you can refer to :
DAX USERPRINCIPALNAME - Use in RLS - Power BI Docs

And for how dynamic rls sample model , you can refer to :
Dynamic Row Level Security with Power BI Made Simple - RADACAD

If this post was helpful, please consider marking Accept as solution to assist other members in finding it more easily.

If you continue to face issues, feel free to reach out to us for further assistance!