do I have to assign user the RLS role for dynamic security?

[steve_czv]

I implemented dynamic RLS security to allow user's access to data based on his/her user principal.  However, I found it very annoying that I need to configure the security on power bi service to assign each individual user the dynamic RLS role.  Without it, the user cannot access the report.

My question is, is there any way to avoid this role assignment?  I feel it is a unnecessary burden since the user's access will be determined based on his credentials already.

thanks

[Anonymous · Accepted solution]

Hi  @steve_czv ,

You can try to create a group in the admin center to correspond to a role, put all users belonging to this role in this group, and set this group to role.

In this way, in a new report that uses dynamic RLS requirements, you can directly use group to set the role, instead of setting the user to the role one by one again.

https://docs.microsoft.com/en-us/power-bi/admin/service-admin-administering-power-bi-in-your-organiz...

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[blopez11]

As @KNP mentions, each person or group does have to be assigned to a role.  I agree if there is only one role, then it seems redundant.  However, there are times when there are multiple roles, for example, one for admin folks who get to see everything, and others who need their data filtered

[KNP]

It is my understanding that you do have to assign each user (or group) to a role. I agree this is confusing and seems pointless when using UPN.

There is an idea somewhere on this issue, I'll see if I can find the link.

Edit (link to idea): https://ideas.powerbi.com/ideas/idea/?ideaid=27a0e121-51c0-4909-94c2-a1dc472a4a49