RLS not working on powerbi online

[mccollough]

Hi Everyone!

I have an interesting issue.

RLS applies correctly when using Power BI desktop for all users.

When I publish the same report to a workspace, RLS only applies to a small subset of end users.

None of these particular end users appear to have anything in common other than they can see all the data.

Any ideas on where to look for some clues as to what might be going on? 

Thank you for your help ❤️

[mccollough · Accepted solution]

So I found a temporary solution to the problem.
Create a new workspace and publish the report there.

It appears to work, at least for a little while.
I'll update this post if I find something more permanent.

[v-rzhou-msft]

Hi @mccollough 

If RLS works well in Power BI Desktop when you view as these end users, it means that you set RLS correctly. But your RLS won't work for many end users in Power BI Service, they could see everything. I think you need to check these end users' role in your workspace. If your end users are the roles with build permission in you workspace, RLS won't work.

New workspace:

If you publish your Power BI Desktop report to a new workspace experience in the Power BI service, the RLS roles are applied to members who are assigned to the Viewer role in the workspace. Even if Viewers are given Build permissions to the dataset, RLS still applies. For example, if Viewers with Build permissions use Analyze in Excel, their view of the data will be protected by RLS. Workspace members assigned Admin, Member, or Contributor have edit permission for the dataset and, therefore, RLS doesn’t apply to them. If you want RLS to apply to people in a workspace, you can only assign them the Viewer role. Read more about roles in the new workspaces.

Classic workspace:

If you have configured a classic workspace so that members have edit permissions, the RLS roles won't be applied to them. Users can see all of the data. Read more about classic workspaces.

For more details, you may refer to this offical blog.

Best Regards,
Rico Zhou

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[parry2k]

@mccollough when you renamed the report and publish it, are you adding users to RLS rules?

[parry2k]

@mccollough that's weird, assuming the dataset in the power bi service is the same as in desktop?

[parry2k]

@mccollough what happens if you try View As in the desktop for the same users, does it work correctly? That will be the first thing to test.

✨ Follow us on LinkedIn

Learn about conditional formatting at Microsoft Reactor

My latest blog post The Power of Using Calculation Groups with Inactive Relationships (Part 1) (perytus.com) I would ❤ Kudos if my solution helped. 👉 If you can spend time posting the question, you can also make efforts to give Kudos to whoever helped to solve your problem. It is a token of appreciation!

⚡ Visit us at https://perytus.com, your one-stop-shop for Power BI-related projects/training/consultancy.⚡

[mccollough]

@parry2k  It works correctly with desktop, but incorrectly with Power BI online

[mccollough]

@parry2k 
Yep same report!
What's interesting is that if I save the report under another name (Reportname.pbx  -> Test.pbx) then it breaks. The users who RLS used to work for now see a "Restricted Data" error while the users for whom RLS wasn't applying still see everything.