Multiple RLS using SSAS 2016

[PBI-IK]

Hello,

I'm using an existing tabular model SSAS 2016 with roles ( 1 for admins without RLS and another one with RLS for all basics users)

This RLS filters rows using the country by DAX and the username(). Example : User A => France, User B => Europ , User C all

My problem is that i need to create new reports with the same model but with differents RLS.

exemple 

new report 1 : User A => Europe, User B => all , User C => no access

new report 2 : User A => ALL , User B=> no access , User C => no access

I have no idea to how do that with a single model. I can create a model for each case but it will requiere to make any evolution in all models.

Do you have any solution ?

Thank you by advance

[lbendlin · Accepted solution]

RLS is based on tables, not reports. So if you want to implement different RLS for different reports then by definition you need different (reference) tables that hold the RLS data - for example collections of user-country lists.

The "All"  access can be implemented in different ways - for example by creating a Role with no logic, or by listing ALL countries against a user in the reference table.  It's your choice, but if you have these frequent changes then I would go with the latter approach, it is safer.

[v-kelly-msft · Accepted solution]

Hi  @PBI-IK ,

As for the limitation of RLS:Only Import and DirectQuery connections are supported. Live connections to Analysis Services are handled in the on-premises model.

If you import your model to power bi ,you could duplicate the table and set the role rules separately,and you will see:

For details,you could check my .pbix file attached.

But if you are using live connection,you could only set RLS in the model and differenct RLS may not be supported,for reference,pls see below:

https://docs.microsoft.com/en-us/power-bi/connect-data/desktop-tutorial-row-level-security-onprem-ss...

Best Regards,
Kelly

Did I answer your question? Mark my post as a solution!

[PBI-IK]

Thank you for you answer. unfortunatly i cannot import the model. We have almost 1billions rows on fact tables...

The model is too complexe to dupicate Dimensions. End users will be lost... i have no others solutions to create separated model for eachs reports/applications.

Thank you

BR

[lbendlin · Accepted solution]

RLS is based on tables, not reports. So if you want to implement different RLS for different reports then by definition you need different (reference) tables that hold the RLS data - for example collections of user-country lists.

The "All"  access can be implemented in different ways - for example by creating a Role with no logic, or by listing ALL countries against a user in the reference table.  It's your choice, but if you have these frequent changes then I would go with the latter approach, it is safer.

[PBI-IK]

Yes i know that RLS is based on tables and not reports. You confirm my initial diagnotic. 

Thank you for answers !!

BR