Row Level Security not working in Power BI with Groups

2
votes

I am running in this strange issue:

  • first I prepared some report with power BI desktop
  • then I go into "Manage Role" to create a rule that show data only for region ="Italy"
  • I upload the report to the power BI Services
  • I go to the security tab under dataset and associate some users ([email protected]) to the rule
  • Finally I create a sharepoint page, where I embed the reports I prepared
  • When I access the report with [email protected] I see all the data and not only the region = "Italy" as desired.

What is wrong with the rule? Another strange thing is, testing the rule is fine, when I test an user the rule doesn't work...

Anybody anyidea? thx a lot!

2
powerbirow-level-security
Not sure, but the creator of the report might be able to see everything regardless of what other roles they're in since RLS will show all data the user is permissioned to view ("or" logic rather than "and"). – Alexis Olson

2 Answers

4
votes

The typical "gotcha" is that the Power BI App Workspace (group) settings are left to the default: Members can edit Power BI content. For RLS to work, this needs to be changed to Members can only view Power BI content.

You make this change by logging in to app.powerbi.com (as a group admin), and using the left nav to choose the App Workspace (group) and then Edit Workspace.

This is described in the doco:

https://docs.microsoft.com/en-us/power-bi/service-admin-rls#using-rls-with-app-workspaces-in-power-bi

0
votes

If you publish your Power BI Desktop report to a workspace within the Power BI service, the roles will be applied to on read-only members. You will need to indicate that members can only view Power BI content within the workspace settings.

Note:

If you have configured the workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data.

official documentation: Using RLS with workspaces in Power BI