row level security

[tespinal]

Good Afternoon,

I was testing out RLS with my supervisor today. I added her to my role and checked to verify everything was working. I then removed her from the role and everything errored out. I assume that make sense because my guess PBI was viewing it as this person can no longer view the dashboard. I then removed her from sharing, then reshared the dashboard and she still couldn't see the dashboard. I then pulled the whole dashboard down and republished it, and she still couldn't see the dashboard. Finally, I pulled the dashboard down, delted the role, and republished, but she STILL couldn't see the dashboard.

Can anyone explain what is happening?

I tried sharing the same dashboard with another user to see if sharing was the issue, but everything worked when I shared with the new user. 

Any help would be appreciated!

[tespinal · Accepted solution]

Update:

I was able to solve the problem by pulling everything down from the affected report from Power BI online (dashboard, report, and dataset). When I republished the report after doing that, everything worked as normal. 

[tespinal · Accepted solution]

Update:

I was able to solve the problem by pulling everything down from the affected report from Power BI online (dashboard, report, and dataset). When I republished the report after doing that, everything worked as normal. 

[KHorseman]

After publishing,  you have to go to the dataset's Security settings and add each user to their role there. Sharing alone is not enough with RLS.

[tespinal]

Thank you for the feedback. My issue is when I wanted to remove her from the role and grant her full access again. When I tried to reshare the dashboard, it didn't let her see anything. 

[KHorseman]

If you aren't assigned any role you won't see anything.

[tespinal]

Understood, thanks for the tip. That will be helpful when I create future roles. 

[KHorseman]

You can create an "Admin" role with no filters for users who should have full access.

[tespinal]

Fantastic! Thanks. That is going to help immensly. I'll need to create several roles in the near future. So if I create a limited role, then I need to assign a role to everyone whether or not they are in the limited role group? I.E if I create a limited role, then anyone I share a dashboard with will not see anything until I assign a role to them like the admin role?

[KHorseman · Accepted solution]

@tespinalexactly right. No role = no data. No-filter role = all data. Filtered role = filtered data.

[tespinal]

Got it. Thank you very much for all of your help!

[KHorseman]

You're welcome.

Now, if only I could figure out how my RLS has managed to somehow filter the results from one column of a table without filtering those same rows in any other column. That shouldn't even be possible...