PowerBI RLS - Reports embedded in Sharepoint Online

[BB9]

Hi,

Use case: Embed reports in Sharepoint online so the users can see the filtered data assigned to them. The data is in Excel (plan is to add this to SQL Server, but for now the data resides in an Excel sheet). The end users are free PowerBI users.

We have a premium dedicated capacity. The reports are published to this capacity. I have created a role in PowerBI desktop and used UserPrincipalName() and when I am viewing as a role in the Desktop, it is displaying the right filtered data. However, when I am publishing the report to SharePoint online and embedding the report, the end users are not seeing the filtered data, They are actually seeing everything. Can you please look into this?

[romgut]

so, does RLS apply in the embedded (in teams or sharepoint) report or not?

- just tested it and it's working fine. Same RLS in both - online and in Teams

[v-xicai]

Hi @BB9 ,

1.Did you add members to the RLS in Power BI Service ? See more: https://docs.microsoft.com/en-us/power-bi/service-admin-rls#manage-security-on-your-model.

2.Did you run "Test as role" to see the RLS effect? RLS wouldn't work on the owner of the dataset. Because the owner can edit both the dataset and reports. RLS aims at controlling the data access rather than something like filtering. .

3.In addition, if you publish your Power BI Desktop report to an app workspace within the Power BI service, the roles will be applied to read-only members.

If you have configured the app workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data.

4.Following is a list of the current limitations for row-level security on cloud models.

• If you previously defined roles and rules in the Power BI service, you must re-create them in Power BI Desktop.
• You can define RLS only on the datasets created with Power BI Desktop. If you want to enable RLS for datasets created with Excel, you must convert your files into Power BI Desktop (PBIX) files first. Learn more
• Only ETL and DirectQuery connections are supported. Live connections to Analysis Services are handled in the on-premises model.
• Cortana is not supported with RLS at this time.

Best Regards,

Amy

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[BB9]

Hi @v-xicai 

I have added the users to the role, tested view role as and its working.

We currently use premium workspace and publish the reports to sharepoint. We opted for premium because we can avoid the pro licenses for all the end users and also make it easy to maintain as there is no need to add all the users to the workspace.

When I don't add the users to the workspace, the end users are unable to view any data irrespective of pro or free user. However, I got it to work when I created a shared workspace and added all the users both to Sharepoint and the PowerBI workspace, but this should not be the case as per MS website. I am not sure if I am missing anything in this scenario. It make it very difficult to maintain when we have to add a lot of users, remove, managing the permissions.

Any thoughts?

Thank you!