Roles not working correctly

[WEB3]

Hello,

I have created my powerbi-presentation in Powerbi-desktop and published it. Now I have set a role with 'Manage roles'.

After publishing my powerbi report from Powerbi desktop, I went to the workspace where the dataset report was published. There I went to security and indeed I see the role name I created there. After that I linked some email addresses to the role.

When I click 'Test as role', it works exactly as I intended. However, if a user with an email address linked to the role uses the report, this user will still see all the data.

So the role settings don't work. What could I have done wrong and what could I have forgotten?

Thanks for your comment.

Eric

[TomMartens · Accepted solution]

Hey @WEB3 ,

if you publish your Power BI Desktop file to the workspace, with Row Level Security (RLS) implemented it's essential to understand, that RLS will not apllied if users are accessing the content from inside the workspace.

You have to create an app from the contents of the workspace and grant users access to the app, instead of adding users to the workspace.

I always recommend that only users who are creating content (reports and dashboards) should be added to the workspace.

There is only situation where RLS will be applied if content is accessed from inside a workspace and not via the app, and this is when users have been the Viewer role assigned.

Remove users who are only content consumers from the workspace and provide these users access to the app.

Hopefully, this helps to tackle your challenge.

Regards,

Tom

[WEB3]

Hi @TomMartens ,

Thanks for your quick answer.

I haven't actually made an app yet. I'll have to dig into that a bit more.

I have changed the rights of these users to Viewer. Unfortunately, that has no effect on what they have access to.

Eric

[WEB3]

Hi @TomMartens ,

I now have the app. After that, the access rights worked properly!

Thanks again for your answer

Eric

[Burningsuit]

Hi Eric,

The other users in the workspace need to be "Viewers" only. Then they will be subjecty to Row Level Security. If you have users in the Workspace that are "Members" "Contrubutors" or "Admin" they are not subject to Row Level Security so they will see all data.

Hope this helps

Stuart

[WEB3]

Hi @Burningsuit ,

Unfortunately that has no effect. The users that I have now set as Viewer still have access to all data.

Eric

[Burningsuit]

Hi Eric,

If your RLS is testing correctly, it may be that the Viewers on the workspace still have "build" rights on the Dataset, which defeats RLS.

To test this, remove one of the viewer accounts from the Workspace completely. Then share the Report with them using the "share" dialog, so that the report is in their "Shared with me" folder. Then see if the user is subject to RLS on that report. They should see the data subject to RLS, if they see the whole data, then your RLS code is wrong. Add them back as a "viewer" to the Workspace and test again.

Hope this helps

Stuart

[WEB3]

Hi Stuart,

Thanks for your reply.

I made an app for the dataset. After this, the access rights worked correctly!

Eric