cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
nirmit27
Helper II
Helper II

Dynamic RLS not working consistently - sometimes Access Denied (RLS), or shows All data

Hi,

I am using dynamic RLS with USERPRINCIPALNAME() and published the report to a workspace. The report is added to App and users are given acces via App only. About the workspace - The workspace was an existing old workspace which seems to have got automatically created when we created a Sharepoint project site back in past. We decided to use the same workspace couple of days back to publish the report. We did upgrade the workspace to New workspace experience using simple Upgarde link.

I have added user under App > permission and also added user email address under Security RLS role in dataset as required. Since user email address is not currently added in profile file hence as per dynamic RLS, he should not be able to see anything since there will be no matching profile. Everything works as intended when I test using "Test as role" in both Desktop and Power BI Service.

 

When user logs in for the first time and accesses the App link, he does not see anything as expected. But surprisingly, as soon as he "refreshes" the browser, he starts sees everything! We tried multiple times and observed the same behaviour. I am complete loss as to what is happening and what am I possibly missing? Can someone please guide?

 

Note1: There are more users having access to correspoding Sharepoint site than those assigned in workspace. Not sure if there is a link. This test user does not have acces to either the Sharepoint site or the Power BI Workspace (not even Viewer). Its not needed if I am not wrong to access the App. 

Note2: RLS DAX filter is added to 2 dimension tables and both eventually connect to Fact table in (extended) Star Schema model shown below. There are some bi-directional relationships in which "Allow security filter in both directions" is enabled.

nirmit27_1-1640282396451.png

 

 

4 REPLIES 4
Ailsa-msft
Community Support
Community Support

Hi @nirmit27 

Did you add the user in your classic workspace ? If yes , you need to pay attention to the roles in new workspace , because after the upgrade, the permissions corresponding to the role have changed.

Ailsamsft_0-1640590298796.png

Best Regard

Community Support Team _ Ailsa Tao

nirmit27
Helper II
Helper II

@lbendlin There are not any relationship arrows pointing towards RLS table. Which ones are you talking about?

Update - RLS is working fine when report published to another brand new workspace. But still does not work in old workspace resulted from sharepoint site.

Your screenshot shows bidirektional search arrows.

lbendlin
Super User
Super User

You cannot have search arrows pointing towards the RLS table. That negates the idea of RLS.  Search can only ever flow down from the RLS dimension into the facts.

Helpful resources

Announcements
May 23 2022 epsiode 5 without aka link.jpg

The Power BI Community Show

Welcome to the Power BI Community Show! Jeroen ter Heerdt talks about the importance of Data Modeling.

charticulator_carousel_with_text (1).png

Charticulator Design Challenge

Put your data visualization and design skills to the test! This exciting challenge is happening now through May 31st!

Power BI Dev Camp Session 22 with aka link 768x460.jpg

Check it Out!

Join us on Thursday, May 26 at 11a PDT for a great session with Ted Pattison!

Power BI Release May 2022 768x460.png

Check it out!

Click here to read more about the May 2022 updates!

Top Kudoed Authors