PBI Desktop and Service different behavioral for RLS testing (View as Role vs Test as role)

[tomas12344]

Hi

For a customer i have created a PBI Report with RLS.

I have tested the report in Dektop, and for the RLS i have used the View as Roles with setting some user and the role, that i have created for RLS. In this case everything worked as expected.

When i have published the report to PBI Service, and wanted to test the report the same way, it did not worked. In Service i have selected for the dataset the Security setting, and choose for the role Test as role. In the report i see, the message "Now viewing as" the role. But in this case, there is different behavioral to PBI Desktop:

- when i set "Now viewing as" the role i have created, it is working, but only for my account. When i choose in the "Now viewing as" different person (email ID), the report do not reflect this change. (i have added a measure for userprincipalname and username function, and it display my IDs, not the user i have set). When i choose different user, i cannot choose, to view as the role, that i have created for the RLS. (i think, this is the difference between the Service and Desktop), and therefore, when i set "Now viewing as" different person, it dont work.

- when different user loged to PBI Service, wiht his credentials, and opened this report, it worked as expected (the user see only, what shold be displayed).

The question is, if you have the same expirience? Is this a bug or feature? This is working different than in PBI Desktop

Thank you.

[v-cgao-msft]

Hi @tomas12344 ，

Not a mistake.

Within Power BI Desktop, Other user displays different results only if you're using dynamic security based on your DAX expressions.

Please refer.

Row-level security (RLS) with Power BI / Validate the roles within Power BI Desktop

Best Regards,
Gao
Community Support Team

If there is any post helps, then please consider Accept it as the solution to help the other members find it more quickly. If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

How to get your questions answered quickly -- How to provide sample data

[tomas12344]

Yes, this i understand, as i have qritten.  But i would except the same behavioral in PBI Desktop and Service (i mean when using the function to test RLS).

[v-cgao-msft]

Hi @tomas12344 ,

Sorry, I didn't read the question clearly.

// When i choose in the "Now viewing as" different person (email ID), the report does not reflect this change.
1.different person (email ID) Does this user ID have access to the dataset?

For example, if I add the test id to the aa role, when I use view as aa it displays correctly, but when I enter the id above it, it displays all the data because I have full access to the dataset.

This user is the administrator of the workspace and has full access to the dataset in the workspace.

If that's not the reason, you can also refer to this, or alternatively share more details of the test. Thanks in advance.
Avoid using RLS

Best Regards,
Gao
Community Support Team

If there is any post helps, then please consider Accept it as the solution to help the other members find it more quickly. If I misunderstand your needs or you still have problems on it, please feel free to let us know. Thanks a lot!

How to get your questions answered quickly -- How to provide sample data

[tomas12344]

HI

Yes, the user, with wich i test the RLS has access to the report. And when the user log in with his credential to PBI Service, the RLS is working as expected. User is only Viewer.

The "Now viewing as" is working, only when i log on, with my credentials and choose to view as the role, i have created for this purpose. I'm creator of the report and have Member access. When i choose to view as different user, (enter the ID to Now viewing as), it does not shows correctly the results, it shows the data as i can see it, that means without the RLS. In this case, when i use the userprincipalname function, it show my ID (as i'm logged).

When using the same in PBI Desktop (same report, rls,..., View as ... email ID) in this case (testing), with the userprincipalname function i see my ID (ID i mean always email, as this is the log in to service). 

the problem is, that in dektop and Service, i get different results, when testing RLS. But when user log in to service with his credential, it works. 
The test case is very simple: 

1. create report and rls in Desktop

2. set up RLS in Desktop

3. test RLS in Desktop - working, when i choose Modeling->View as-> AA(choose role, that was created (testing under my ID)), or later choose View as-> AA (choose role) and enter "Other user" =a@abc.com - THIS IS WORKING - both. I see, what should, base on the RLS.

4. publish to Service

5. set security on the corresponding dataset, add user to the role AA in Service

6. then on the corresponing dataset  - Security->AA(Role created)->Test as role

7. then in report (which opens), when loged with my credential, i choose Now Viewing->Select Role =AA - THIS IS WORKING. I see, that shoudl be, base on the RLS.

8. then i set ID of other user to Now Viewing as->Select Person ( i put email ID).  THIS IS NOT WORKING. The userprincipalname function show my ID in Service(for this case), but in Desktop, i see the other person ID, i have set.
The email ID must be correct, because when the user log in to Service, the RLS is working. the RLS rules are set base on email ID of the user.