Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Earn the coveted Fabric Analytics Engineer certification. 100% off your exam for a limited time only!

Reply
KamilSzpyrka
Helper III
Helper III

Allow users to edit report within their RLS security context

Hello,

I know this subject was mentioned in the forum, but posts are rather old, so I decided to reopen this topic.

 

Case Scenario: We have 100 users with one RLS role assigned to them. RLS is based on dynamic formula interacting with comapny's hierarchy, so users see only data related to their field of work. Everything works fine, when users have view only access to reports.

 

Question: Is there any possibility (strategic or workaround) to allow users edit reports, while still keeping RLS security option?

 

Regards,

Kamil

1 ACCEPTED SOLUTION
bcdobbs
Super User
Super User

We use a master dataset which has all of the RLS built into it. 

 

Reports are then "thin" and connect into that central dataset.

bcdobbs_0-1641547192784.png

We then give users (that have had some power bi training) build permission on the dataset which lets them create reports. They can create new local report measures but can't change the RLS.



Ben Dobbs

LinkedIn | Twitter | Blog

Did I answer your question? Mark my post as a solution! This will help others on the forum!
Appreciate your Kudos!!

View solution in original post

7 REPLIES 7
bcdobbs
Super User
Super User

We use a master dataset which has all of the RLS built into it. 

 

Reports are then "thin" and connect into that central dataset.

bcdobbs_0-1641547192784.png

We then give users (that have had some power bi training) build permission on the dataset which lets them create reports. They can create new local report measures but can't change the RLS.



Ben Dobbs

LinkedIn | Twitter | Blog

Did I answer your question? Mark my post as a solution! This will help others on the forum!
Appreciate your Kudos!!

Hello,

 

but from what I understand the user still can see all the data included in master data set?

That's not my experience.

 

In:
Row-level security (RLS) with Power BI - Power BI | Microsoft Docs

 

 It states

 

If you publish your Power BI Desktop report to a new workspace experience in the Power BI service, the RLS roles are applied to members who are assigned to the Viewer role in the workspace. Even if Viewers are given Build permissions to the dataset, RLS still applies. For example, if Viewers with Build permissions use Analyze in Excel, their view of the data will be protected by RLS. Workspace members assigned AdminMember, or Contributor have edit permission for the dataset and, therefore, RLS doesn’t apply to them. If you want RLS to apply to people in a workspace, you can only assign them the Viewer role. Read more about roles in the new workspaces.

 

In our case the master models sit in a separate workspace which users are not members of at all. Users are only given build permission on the models. They then publish to other workspaces which they have permissions on.

 

To be clear we let users build and edit reports. We don't let them edit the master models. Wonder if that's where the confusion is coming in?



Ben Dobbs

LinkedIn | Twitter | Blog

Did I answer your question? Mark my post as a solution! This will help others on the forum!
Appreciate your Kudos!!

Thanks, I think it clarifies the confusion.

Can you please share how can I allow viewers to modify reports? I cannot find this option.

So mostly our users create fresh reports straight from the dataset however you could....

 

1) Share existing pbix files and have them edit in Power Bi desktop. Never used it but you could look at pbit templates.

 

2) If they have sufficient workspace permission when you open a report (you actually have to go into it!) there is an edit button at top:

bcdobbs_0-1641551929040.png

 



Ben Dobbs

LinkedIn | Twitter | Blog

Did I answer your question? Mark my post as a solution! This will help others on the forum!
Appreciate your Kudos!!

Are they allowed to create new report from dataset direcetly in Power BI Service? I cannot recreate this in my enviroment...

Ok, now I get it. User can access dataset but only from Power BI Desktop or different Workspace in which he has edit options. This totally resolves my issue. Many, many thanks!

Helpful resources

Announcements
April AMA free

Microsoft Fabric AMA Livestream

Join us Tuesday, April 09, 9:00 – 10:00 AM PST for a live, expert-led Q&A session on all things Microsoft Fabric!

March Fabric Community Update

Fabric Community Update - March 2024

Find out what's new and trending in the Fabric Community.