row level security working on dashboards and not reports

[adcook]

I have created row level security in PowerBI desktop off of some data I pull in nightly from an Azure SQL Server. The file uploaded to PowerBI fine, and I am able to see the row level security groups on the web in the service that I created on the desktop client. I can also add members to the various RLS groups fine. When I test out the view in my login, It works great on both the dashboards and reports. The user group can only see the relevant data that I have filtered down to via my row level security. However, when the user I assigned to the row level security group logs in, it only filters down the data on the dashboards I have shared out to them, and does not filter the reports I have shared out to them via content packs (They still see all data). Is there any reason why the only data that is filtering via the row level security would be the dashboards, and the reports would not work? What is odd is that when I test the group on my end it works fine for both reports and dashboards.

Second, I notice that any user I dont assign to a RLS group get a access RLS error on data on dashboards (since that is working). I just want to verify that if you set up RLS in your dataset that if a user is not assigned to a filtered level, than they will not have any access? I originally thought they would have global access to data if they are not assigned to a RLS group. I have since created a RLS group with no filters and assigned everyone to it that needs global access, but I wanted to confirm that this is indeed how it should work.

Thanks!

[v-ljerr-msft · Accepted solution]

Hi @adcook,

---

---

However, when the user I assigned to the row level security group logs in, it only filters down the data on the dashboards I have shared out to them, and does not filter the reports I have shared out to them via content packs (They still see all data).

Row-level security won't work with content packs, as all group members have the same permissions to the data as the content pack creator. See Data security for content packs.

In order to apply RLS with Groups in Power BI, you need publish your report to a group within the Power BI service, the roles will be applied to read-only members. You will need to indicate that members can only view Power BI content within the group settings. For more details about this, you can refer to this article.

---

Second, I notice that any user I dont assign to a RLS group get a access RLS error on data on dashboards (since that is working). I just want to verify that if you set up RLS in your dataset that if a user is not assigned to a filtered level, than they will not have any access? 

---

Yes, if a user is not assigned to any role, then the user won't have access to the report.

Regards

[MickF]

According to Microsoft, RLS is designed to work with Content Packs. I'm very grateful to Patricia, Sirui, Shravan and Michel who have spent a lot of time with me investigating this issue. 

RLS won’t work on content packs if RLS was enabled on the datasets as part of a content pack update, as opposed to at creation time.

So, as a workaround, you need to create a new Content Pack and apply RLS to that.

I believe Microsoft are working on a fix to the underlying problem, but this worked for me.

Hope this helps others with the same issue.

Many thanks,

Mick

[adcook]

@v-ljerr-msft, I do have one follow-up question. So to get it to work I will need to re-think my setup to migrate from content packs to groups. I have over thirty different reports feeding off of a single dataset in myWorkspace, and then I manage access via various content packs to the organization. So to get RLS to work, is there an easy way to migrate to groups from myWorkspace? It seems like it would be redundant to copy the same dataset to every desired group I may have within an organization. I don't want everyone to see all reports in the company. Also, I worry that I would also have to recreate all my reports in each group? Is there an easy way to manage this? Or do you know if RLS with content packs is on the roadmap? Any advice on this would be appreciated. It just pains me that I have invested so much time on deliverying content packs from myWorkspace and it may end up pidgeon holing me in a place where I wont be able to leverage RLS going forward?

Thanks again for all the info, its awesome that there is a place like this to get good advice.

[v-ljerr-msft]

Hi @adcook,

---

---

Or do you know if RLS with content packs is on the roadmap?

Someone has already shared the idea here. You can vote it up to make this feature coming sooner.

In addition, please also check if Make a copy feature could help in your scenario.

Regards

[adcook]

Thanks.

[adcook]

Thanks @v-ljerr-msft! This is super helpful. I appreciate the quick response.