dynamic row level security
15 TopicsDynamic Row level security issue
Hi all, We are using Power BI Report Server. I am having some issues while implementing Dynamic Row Level security. The requirement is employees would need to see only thier related data in the dashboard. This is what I have tried so far and here is the below sample dummy data to give rough idea: BilledHrs table EmployeeID TranDate BilledHrs 100 12/01/2026 2.8 100 12/01/2026 3.5 100 13/01/2026 7 100 14/01/2026 0.5 100 14/01/2026 3.8 200 12/01/2026 7.5 200 13/01/2026 7.5 200 14/01/2026 2.6 200 14/01/2026 4 200 15/01/2026 6 200 15/01/2026 7.5 Employee table EmployeeID Name Login Email 100 John Kerr domain\JK [email protected] 200 Steve Barr domain\SB [email protected] So, when employee JK views the dashboard they should see only thier billed hours and when employee SB views the dashboard they should see thier billed hours only. After publishing dashboard normally if any user wants to have access to the dashboard we give their AD login access to that dashboard i.e. domain\login to that dashboard and they will have access to that dashboard. So, I have created a new role named login and I have filtered to the Employee table - Login = USERNAME() and published it to the report server. And in the report server, there is a AD group named domain\AllEmployees. So. under RLS I have created this domain\AllEmployees and mapped to the Login role. But when viewing the dashboard I couldn't see any data relating to my login JK. I have noticed that USERPRINCIPALNAME() is returning email address and USERNAME() is returning local windows account (domainname\login) in Power BI desktop. But after publishing to the report server, both USERPRINCIPALNAME() and USERNAME() are returning email address only and this is where my row level security seems to be not working I guess. Can you please let me know if I am doing anything wrong and point in the right direction ? Thanks grkanth81Solved1.3KViews0likes4CommentsDynamic row level security and local Report Server
Dear Community, I have created a dynamic role using Row Level Security. In Power BI Desktop, this dynamic role works perfectly. The purpose of this role is to ensure that employees can only see the data relevant to their own organizational unit. However, when I publish this report on the local report server and grant user permissions, they are unable to see any data. Do you have any explanation for what the problem might be? Additionally, if you have any suggestions or solutions to resolve this issue, I would greatly appreciate your help. Thank you in advance for your assistance!Solved1.2KViews0likes3CommentsAD group name gets changed when adding Row Level Security
I have created a dashbaord that is meant to only show the data for the current logged in user. I followed the directions at Row-level security (RLS) in Power BI Report Server - Power BI | Microsoft Learn to set up Row Level Security to accomplish it and it works when I explicitly add a users username as a member on the Report Server. The issue I am running into is when I try to add one of our AD groups as a member, the name of the group gets an extra space added to it after it is added. I have tried multiple times typing it correctly and have double checked that it is the correct name in AD, but every time I save it the extra space is added. If I try to add the correctly typed group name while the group with an extra space is in the list, it errors out and says that something went wrong. Since the name has the extra space in it, it doesn't show a user their data on the dashboard if they are in the group. For example, I'll type in the AD group (not the actual group but same structure): "IT-GROUP-Name" and when it saves it is changed to "IT-GROUP- Name". There is an extra space added after the second dash. Any ideas? Thank you898Views0likes1CommentDynamic Row level security for embedded report in Salesforce
I am trying to apply Row level security for an embedded report which is embedded in salesforce application/server. I know how we can do dynamic RLS for a report published in usual workspace using userprinciple() ... dont know how to approach this scenario. is this even possible currently? anyhow who has done this previously or know the direction we should head to for this scenario? Thank you and much appreciate your thoughts on thisSolved682Views0likes1CommentUpdate data model role assignment (RLS) of PBI report using Powershell
Hi, I need to dynamically update Row level security of power bi report that is deployed to PBIRS. I have used powershell script to get list of users in row level security but I could not find out how to update the list or add users to RLS. here is the step that I have done: $PBIRSUrl = 'https://MyPBIRServer.com' #API to get role assignments $reportRoles = $PBIRSUrl + "/PBIReports/api/v2.0/PowerBIReports(Path='/MyReport')/DataModelRoleAssignments" #call API $result = Invoke-RestMethod -Uri $reportRoles -ContentType "application/json" -UseDefaultCredentials -Method Get #steps to update $result.value and add new user then save it to $roleAssgnmtjson $roleAssgnmtjson @{[ { "GroupUserName": "domain\User001", "DataModelRoles": ["2336b4a-e5b0-49ef-8556-62152375f005"] }, { "GroupUserName": "domain\User002", "DataModelRoles": ["2336b4a-e5b0-49ef-8556-62152375f005"] } ]} #API to update role assignments Invoke-RestMethod -Uri $reportRoles -ContentType "application/json" -Body $roleAssgnmtjson -UseDefaultCredentials -Method Put Invoke-RestMethod : The remote server returned an error: (400) Bad Request. At line:1 char:1 + Invoke-RestMethod -Uri $reportRoles -ContentType "application/json" ... + ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~ + CategoryInfo : InvalidOperation: (System.Net.HttpWebRequest:HttpWebRequest) [Invoke-RestMethod], WebException + FullyQualifiedErrorId : WebCmdletWebResponseException,Microsoft.PowerShell.Commands.InvokeRestMethodCommand does anyone know how to fix the issue? I have also tried using $resultjson for body of put request, but same error $resultjson: { "@odata.context": "https://MyPBIRServer.com/PBIReports/api/v2.0/$metadata#Collection(Model.DataModelRoleAssignment)", "value": [ { "GroupUserName": "domain\User001", "DataModelRoles": "2336b4a-e5b0-49ef-8556-62152375f005" }, { "GroupUserName": "domain\User002", "DataModelRoles": "2336b4a-e5b0-49ef-8556-62152375f005" } ]} ThanksSolved1.2KViews0likes1CommentManage Security Roles - Row Level Security summary figures
Hi all, My dashboard shows sales and call figures for by postcode, territory, region and national levels. I have assigned Sales reps who can only view sales and calls by their territory, whilsts Regional Sales reps can view sales and calls by their region and the split by territory whilst a select group can view all sales and calls by each region and territory. Is there a way where the Sales rep can still only view their territory but can see the total for their region and the total national figure, and the same for Regional sales reps, can they view their full region breakdown but also the national roll up? The purpose is so that each viewer can see how they are comparing to 1. National Figures and 2. Their Region. Thank you in advance!!747Views0likes1CommentMultiple positions in organizations hierarchy RLS in Power BI server
Hello I want to apply RLS to my data as per hierarchy level , however there are multiple positions I want user to view data of users who are 2 level below him Please note I don have level column for example I want user (F) to view data for (F,G and H) same if user (C)logged in he can se data for (C,D,and E) my path is A|B|C|D|E|F|G|H Thank You in advance774Views0likes2CommentsRLS based on Category
Hello , I have employee data with different role , I want to restrict data based on Resource type for example Employee (1) has resource type A and is location head can view only his data being a location head and related resource data fromsales table can you please help1.6KViews0likes7CommentsDynamic RLS with multiple tables
Hi there. I have a reasonably complicated dynamic RLS which i am trying to resolve through dax. Attached is the schema. The premise is the Id in the user table is the USERRPINCIPALNAME The user has a a list of companies they are allowed access to in the USERALLOWED table These companies have a relevant ID called InstanceId-CRMId that gets passed into a site list and on to the report to limit the data. The issue i am haivng is i do not want to have to use bidirectional relationships There iaremany to many relationships Performance is poor I cannot seem to get the RLS to properly work and the sites table isnt filtering when I add ID = USERPRINCIALNAME() in the user table. Can someone suggest specifc dax for this use case please??? I have looked at some RADACAD posts on this example but can't work it out. Thanks in advance!!Solved2.5KViews0likes5CommentsDefault values for slicer
Hi All I am pulling out what little hair I have left with this particular issue related to setting the default value of a slicer for a dashboard that has been configured for Dynamic Row Level Security. Here is my scenario. I have created a dashboard for dynamic row level security using the bridge table technique and then I have published the dashboard to our in house report server (not the service) and tested the data displayed using myself and another member of the team. There is a slicer setup as a single select to choose one of Company A,B,C, or D, It has to be a single select because the data is specific to one company not multiple. I have access to see Company A and B and my team member has access to see Company C and D. All this works perfectly and when I sign on I see A and B and my team member can see C and D. But when I published the dashboard, Company A was selected (because its the first one in the list) and this gets persisted with the published dashboard. Now when my team member signs on she sees that Company A is selected in the slicer and C and D are listed below it. No data is returned for A but its annoying because she only should see C and D. Now for rant time...... When is Microsoft going to sort out this defaulting issue for slicers. There are so many work arounds for defaulting date periods for latest month, etc and I am sure there is a workaround that some clever person is going to give me for my above problem 🙂. BUT SSRS and now even Paginated Reports have had this for ages by having a separate query that is used to supply the default value for a single select or multiple select parameter. When is this seemingly simple idea going to filter or bubble up to the top of the ideas list. I, and most probably half the Power BI family across the world have votes for this but nothing yet. Please Microsoft, you have a wonderful product and all the better now that Fabric has landed but please give us an easier out the box method to have default values for a slicer. Feel better now, comments appreciated.485Views2likes0Comments