row level security
20 TopicsFor Dynamic Row Level Security do I still need to add members on power BI service?
How can I fully implement Dynamic Row-Level Security (RLS) in Power BI without having to manually add users to the role in the Power BI Service under Semantic Model-> More options → Security → Add members? Context: I've implemented Dynamic RLS using a SQL database that contains user emails, and I'm using the USERPRINCIPALNAME() DAX function to filter data based on the logged-in user. This works as expected in Power BI Desktop using the "View as Role" feature. However, in the Power BI Service, some users are unable to see the filtered data unless I manually add them to the RLS role. Since the filtering logic is already dynamic and based on the user's email, I was hoping to avoid this manual step. Is there a recommended workaround or best practice to automate this process and ensure users are recognized by the RLS logic without needing to be explicitly added to the role? under Semantic Model -> More options → Security → Add members?Solved4KViews2likes8CommentsUser IP Address Row Level Security
Hi all, I have a situation where I want to restrict what a user (sales rep) sees based on a site location. For example, if the user logs on from home or Site A, they see all sales; if they log on from Site B, they only see their sales. It's a case where the user is being mentored into a management role, but when at Site B, they don't want prying eyes (open office) to notice that they have more access than everyone else. I was wondering if I could somehow get the IP address where they are logged on, and I could restrict what they see. Any ideas? Thanks Steve835Views0likes1CommentManage Security Roles - Row Level Security summary figures
Hi all, My dashboard shows sales and call figures for by postcode, territory, region and national levels. I have assigned Sales reps who can only view sales and calls by their territory, whilsts Regional Sales reps can view sales and calls by their region and the split by territory whilst a select group can view all sales and calls by each region and territory. Is there a way where the Sales rep can still only view their territory but can see the total for their region and the total national figure, and the same for Regional sales reps, can they view their full region breakdown but also the national roll up? The purpose is so that each viewer can see how they are comparing to 1. National Figures and 2. Their Region. Thank you in advance!!747Views0likes1CommentHow to do Row Level Security in PBI Report Server using live connection from SSAS cube
The data in SSAS cube. The cube has 1 flat table. No dimensions. All the relevant data is in this table. The reports are housed in the Power BI Report Server The table has a column called "ClientName" which lists the clients. The ClientName column has values like APPLE, GOOGLE, REDDIT etc. There are a about 8 clients like these. The goal of RLS is that we have a common report to be viewed by all users at all the clients' companies but the people at APPLE should only see data for the rows that have ClientName as Apple, and so on. We created 8 Active Directory groups for the 8 clients. And users from the client companies were added appropriately to them. For the actual RLS these are the steps I have followed. 1. Created Roles on the SSAS cube using SQL Server Management Studio. 2. Assigned only 'Read' permissions to the role 3. In the members tab, added the appropriate AD group to the role. 4. In the Filters tab, assigned the filter using DAX. For example for the Apple role, the expression was ='TABLENAME'[ClientName]="APPLE" A sample report was created with the ClientName column in a matrix visual. This report was uploaded to the Power BI report Server. In internal testing, this worked perfectly. We created a test cube that was identical to the production cube. Added a couple people from our own company to each of these AD groups. We assigned these AD groups to roles in the test cube. They were able to see only the ClientName assigned to them. We then tried testing with actual client users. Created a test report with a single visual as above with the report connected to the actual production cube. But they were able to see all the values in the column. I then tried to repicate the initial test by asking the initial internal users to test the first sample report. (Connected to test cube). But they were able to see all values in the column as well. Whenever I do "Analyse in Excel" in Visual Studio, I get the intended results in all the tests. (RLS is applied) Both on the test cube and the production cube I'm not sure what I'm doing wrong. Some more information: In Manage options for the report, Data Sources > Credentials > Authentication Type is Windows Authentication. And the option "use the following credentials" is selected. A username and password has to be entered in the field there. This was provided by the admin team. I'm not sure what the use of this is but thought I should mention. In Manage options for the report, Data Sources > Connection type is Analysis Services. The Connection String is appropriately edited as below Data Source=SERVERNAME;InitialCAtalog=CUBENAME;Provider=MSOLAP.8;IntegratedSecurity=SSPI;Impersonation Level=Impersonate; As far as I know, none of the users have been added to any of the administrators/developers AD groups. I'm not sure what I'm doing wrong. Please advise. ThanksSolved3.6KViews0likes7CommentsStatic Row Level Security
Hello, I have created row level security roles based on products on the Desktop. On the server, after uploading the report, setting the security configurations, I have configured some of the users to each role. But, I realised that me and my collegues are not assigned to a specific role can not view the report. Instead they receive the message "This visual contains restricted data: to view this visual contact the dataset owner to request acess to the data behind it" How can I configure it and the back-officers view the report filtered to the product they are responsible for (roles) and all the other viewers (managers, directors and my team) to all the data? Thank you in advance, EleftheriaSolved1KViews0likes2CommentsDirect Query and Row Level Security - Do Viewers need to have read access to SQL Server database?
Hello all, I have a question regarding the viewer authentication in PowerBI report using DirectQuery and having Row Level Security applied when it's published in a PowerBI Workspace/PowerBI Service. I am trying to create a PowerBI report using Direct Query storage mode, with RLS applied using USERPRINCIPALNAME() in a dimension table to filter the data in fact tables related to viewers, and there is an enterprise power bi data gateway with a service account authenticated to SQL Server database. So in this case, I wonder whether all viewers are required to have read access to the SQL Server database, so they can see the report with filtered underlying data on PowerBI workspace or not. Or the SQL Server database will use the authenticated service account from the Enterprise Data gateway to run the queries and return the filtered data of the viewer? Because the data in SQL Server database is restricted to give read permission to many users, I wonder if there are any solutions that allow viewers (who don't have the permission to SQL Server database but have the view permission to PowerBI Workspace) to view the PowerBI report with filtered underlying data. Many thanks.Solved1.1KViews0likes2CommentsRow level security - doesn't work for some people
Dear Colleagues, I created a row level security option on the power bi dashboard which is shared via power bi report server. It works for most of the people but I have the case when it doesn't work for some people (they are in the data source with valid ID used for row level security option). They can open dahsbard but it doesn't display data. Do you know what could be the reason? Thank you in advance! AsiaSolved1KViews0likes2CommentsRow level security on power bi reporting server
Hi guys, I want to ask about your advice regarding using row level secutiy option. I have many users (around 4000) that should see only their own information (and I used row level security level) , but also a big group of people (around 2000) that should see everything. Is is possible to have it on one dahsboard? If, yes how this should be applied? Thanks, AsiaSolved1.1KViews0likes2CommentsData is not restricted after applying RLS
I have a master data table and a user group dimension table. And they are joint together in the data model. The use case is, I want to give certain viewer only partial data visiablity to a specific group(usergroup). I was trying to do so by applying RLS (row level security). For example, I created a role where group(aka. usergroup, a column in user group dimension table) = "Technical Team". Then I tested this role by 'View As' function. You can see from the screenshot, the drop down content of group(usergroup) slicer is indeed being limited to "Technical Team". However, the data didn't actually change or say being limited until I clicked on "Technical Team". For some reason, this Role is working superficially, not restricting the data in an automated way.713Views0likes1CommentRow Level Security on power Bi Sever
Hi All, I am using Power BI Desktop and have created a Pbix with Row Level security and it works fine. But when I upload this report on the Power BI Server, it shows below errors for all the visuals. "To view content contact the dataset owner..." Any help is appreciated. ThanksSolved1.1KViews0likes4Comments