Dynamic RLS not working consistently - sometimes Access Denied (RLS), or shows All data

[Anonymous]

Hi,

I am using dynamic RLS with USERPRINCIPALNAME() and published the report to a workspace. The report is added to App and users are given acces via App only. About the workspace - The workspace was an existing old workspace which seems to have got automatically created when we created a Sharepoint project site back in past. We decided to use the same workspace couple of days back to publish the report. We did upgrade the workspace to New workspace experience using simple Upgarde link.

I have added user under App > permission and also added user email address under Security RLS role in dataset as required. Since user email address is not currently added in profile file hence as per dynamic RLS, he should not be able to see anything since there will be no matching profile. Everything works as intended when I test using "Test as role" in both Desktop and Power BI Service.

When user logs in for the first time and accesses the App link, he does not see anything as expected. But surprisingly, as soon as he "refreshes" the browser, he starts sees everything! We tried multiple times and observed the same behaviour. I am complete loss as to what is happening and what am I possibly missing? Can someone please guide?

Note1: There are more users having access to correspoding Sharepoint site than those assigned in workspace. Not sure if there is a link. This test user does not have acces to either the Sharepoint site or the Power BI Workspace (not even Viewer). Its not needed if I am not wrong to access the App. 

Note2: RLS DAX filter is added to 2 dimension tables and both eventually connect to Fact table in (extended) Star Schema model shown below. There are some bi-directional relationships in which "Allow security filter in both directions" is enabled.

[v-yetao1-msft]

Hi @Anonymous 

Did you add the user in your classic workspace ? If yes , you need to pay attention to the roles in new workspace , because after the upgrade, the permissions corresponding to the role have changed.

Best Regard

Community Support Team _ Ailsa Tao

[Anonymous]

@lbendlin There are not any relationship arrows pointing towards RLS table. Which ones are you talking about?

Update - RLS is working fine when report published to another brand new workspace. But still does not work in old workspace resulted from sharepoint site.

[lbendlin]

Your screenshot shows bidirektional search arrows.

[lbendlin]

You cannot have search arrows pointing towards the RLS table. That negates the idea of RLS.  Search can only ever flow down from the RLS dimension into the facts.