Implementing RLS on a shared dataset

[pradeep467]

Hi,

I am trying to design a solution for below requirement. I have a dataset A which has 10 tables+1 security table for RLS. This is published into workspace A and all user access the report through App A. Now if I have to share this dataset with few users who would like to work on this dataset but apply their own RLS, I am seeing 2 options.

1. Share the dataset PBIX file with them so they can customise their own RLS and publish their own reports but that would duplicate the same set of core tables in PBI service.

2. Create dataflow for the core tables in dataset and then share the dataflow with the users so they can add their own RLS onto this dataset, the advantage I am seeing here is the main tables are always a single source of truth avoiding multiple refershes of same tables.

Please advise if these are the only ways or any better way to handle this scenario.

[hsantosh]

Hi , I have shared datasets 1,2,3 and 4. On 3 I have applied required RLS.

When I build report importing these shared datasets and build visuals visuals giving error could not load the data for visuals.

Datasets and report are in different workspace.

Report embdeedd in application there also error . Please help me on this. Multiple shared datasets on top of it if we build report how to configure RLS?

Thank you

[v-xiaoyan-msft]

Hi @pradeep467 ,

Maybe you could consider letting those users who would like to work on this dataset but apply their own RLS try the content in this link Dynamic Row Level Security with Manager Level Access in Power BI  . It is possible to create a dynamic RLS with manager-level access and employee-level access.

Hope it helps,

Community Support Team _ Caitlyn

If this post helps then please consider Accept it as the solution to help the other members find it more quickly.

[v-xiaoyan-msft]

Hi @pradeep467 ,

Agree with GilbertQ .

As you mentioned “the other users have to use the core 10 tables and use their own RLS instead of my RLS to suit their own custom requirement.” 

We suggest that you make the core 10 tables a separate dataset and share it with your users so that they can set up RLS on that basis and assign permissions appropriately, currently Power BI does not support RLS configuration in Dataflow.

Hope it helps,

Community Support Team _ Caitlyn

If this post helps then please consider Accept it as the solution to help the other members find it more quickly.

[pradeep467]

Thanks for the response Caitlyn, that was one of the solution that I had in my mind, but the downside of that is the same 10 tables are being refreshed in both pbix files and any change to core PBIX tables logic has to be shared with the other team as well to maintain consistency. That is the reason I was exploring ways of a shared dataset/dataflow and the adding security table. 

[GilbertQ]

Hi @pradeep467 

If I understand your question (you want other users to add on their own RLS ontop of your RLS), this is currently would not work because the RLS is applied at the dataset level.

You would need to go with option 2, where they would have to create their own PBIX (which is a dataset) and then apply their own RLS there.

[pradeep467]

No Gilbert, just to clarify, the other users have to use the core 10 tables and use their own RLS instead of my RLS to suit their own custom requirement.

[GilbertQ]

Hi @pradeep467 

I would then go with the dataflow tables?

[pradeep467]

Thanks for the quick response, so in my case if dataflows the only best option or are there any other options that I can explore?

[GilbertQ]

Hi @pradeep467 

The only other option would be to import the data from the source?

[hsantosh]

Hi
i have shared datsets 1,2,3 and 4 on dataset 3 RLS is applied. Using these shared datasets as Direct query report is built. Report and Datasets are in different workspace. Report is embedded into application. Report is working fine in service but in application not opening throwing error. Please can you help me on this, it will be very helpful. Thank You.

[pradeep467]

Hi @GilbertQ ,

So as part of the requirment I tried to separate the core dataset from the security table and published the security table as a dataflow and core dataset separately into PBI service. My idea is to integrate this core dataset as direct query in a new pbix file along with my security table from dataflow. I was able to join but on join condition I do not see "Apply security filter checkbox" is that a limitation that I cannot define RLS between a dataset and a table from dataflow?

[GilbertQ]

Hi @pradeep467 

Yeah there currently is no option to do this as I understand.