why RLS and OLS is not working when publish to Power BI Service(we are using Fabric Trial)

[pennyhoho117]

We are now using Fabric Trial License.

and we tried to create RLS Role and OLS Role, and checked it is ok in Power BI desktop,

why after publish to Power BI Service, and add member to the role, it is not working?

Meanwhile, the option Read and Default for Role setting is same?

[Poojara_D12 · Accepted solution]

Hi @pennyhoho117 

Since you are using a Microsoft Fabric Trial License, the issue with Row-Level Security (RLS) and Object-Level Security (OLS) not working after publishing to Power BI Service could be due to limitations in the trial environment or permission settings in the Fabric workspace. In Power BI Desktop, RLS and OLS are validated in the local model, but once published, they rely on the security settings of the Power BI Service. To ensure it works, verify that the dataset is in a Premium Capacity (Fabric Capacity), as RLS and OLS require appropriate licensing to function in the service. Additionally, confirm that you assigned members to the correct roles in Manage Permissions under the dataset settings. Also, check if Users have Build permissions, as granting Build access might allow them to bypass RLS restrictions.

Regarding the "Read" and "Default" role settings, they are not the same. "Read" allows users to access and view the dataset, while "Default" is the automatic role assigned to users when no other role applies. If a user is part of multiple roles, their permissions are cumulative. If security settings still do not apply, check whether the Default role has unrestricted access, which could override RLS/OLS restrictions.

[v-tsaipranay · Accepted solution]

Hi @pennyhoho117 ,

Thank you for reaching out to the Microsoft Fabric Community. Also thank you @Poojara_D12  for your inputs.

Since you are using a Fabric Trial License, it’s essential to ensure that your workspace is running on Fabric Capacity. RLS and OLS require a Power BI Pro, Premium Per User (PPU), or Premium Capacity workspace.

• Navigate to Power BI Service → Workspace Settings → Premium and ensure your workspace is in Fabric Trial Mode and assigned to a supported Premium Capacity. If your workspace is on a shared (Free) capacity, RLS/OLS will not apply.

Refer the following documentation for your understanding:

https://learn.microsoft.com/en-us/power-bi/enterprise/service-premium-per-user-faq

After publishing to Power BI Service, RLS roles must be explicitly assigned to users. Even if RLS works in Power BI Desktop, it will not function in the service unless users are added to the roles.

• Go to Power BI Service → Select the Dataset → Click on Security and add users to the RLS roles you created also ensure users only have "Viewer" permissions (Workspace Admins, Members, or Contributors will bypass RLS).

I am including Microsoft documentation for your reference:

https://learn.microsoft.com/en-us/fabric/security/service-admin-row-level-security#manage-security-o...

Also make sure if users have Build permissions or direct dataset access, they might be bypassing RLS/OLS security settings.

• Go to Dataset Settings → Manage Permission and Remove Build permission from users who should be restricted by RLS/OLS.

You also asked about the difference between Read and Default in role settings. Assign users to the "Read" role to ensure RLS/OLS is applied correctly.

Setting	Description
Read	Grants read-only access while enforcing RLS/OLS. Recommended for users needing security restrictions.
Default	Grants read access without enforcing RLS/OLS, unless explicitly defined.

I hope my suggestions give you good idea, if you need any further assistance, feel free to reach out.

If this post helps, then please give us Kudos and consider Accept it as a solution to help the other members find it more quickly.

Thank you.

[v-tsaipranay]

Hi @pennyhoho117 ,

I wanted to follow up on our previous suggestions regarding the issue. We would love to hear back from you to ensure we can assist you further.

If my response has addressed your query, please accept it as a solution and give a ‘Kudos’ so other members can easily find it. Please let us know if there’s anything else we can do to help.

Thank you.

[v-tsaipranay]

Hi @pennyhoho117 ,

I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions. If my response has addressed your query, please accept it as a solution and give a 'Kudos' so other members can easily find it.

Thank you.

[v-tsaipranay]

Hi @pennyhoho117 ,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[Poojara_D12 · Accepted solution]

Hi @pennyhoho117 

Since you are using a Microsoft Fabric Trial License, the issue with Row-Level Security (RLS) and Object-Level Security (OLS) not working after publishing to Power BI Service could be due to limitations in the trial environment or permission settings in the Fabric workspace. In Power BI Desktop, RLS and OLS are validated in the local model, but once published, they rely on the security settings of the Power BI Service. To ensure it works, verify that the dataset is in a Premium Capacity (Fabric Capacity), as RLS and OLS require appropriate licensing to function in the service. Additionally, confirm that you assigned members to the correct roles in Manage Permissions under the dataset settings. Also, check if Users have Build permissions, as granting Build access might allow them to bypass RLS restrictions.

Regarding the "Read" and "Default" role settings, they are not the same. "Read" allows users to access and view the dataset, while "Default" is the automatic role assigned to users when no other role applies. If a user is part of multiple roles, their permissions are cumulative. If security settings still do not apply, check whether the Default role has unrestricted access, which could override RLS/OLS restrictions.