Problems querying RLS Permissions

[hinin]

Problem

Query to $SYSTEM.TMSCHEMA_ROLE_MEMBERSHIPS is now returning an empty table for semantic model with RLS entries.

Background

• I have a 10GB semantic model, deployed via a pipeline. The model uses incremental refresh (not that it should matter) 
• Until recently I have had a report running that provided visibility of the RLS in that semantic model.
• Recently (unclear when), the below query to get the membership for RLS roles stopped providing data; it still provides all the relevant fields though, just no values. 

let
#"Role Memberships" = AnalysisServices.Database(#"Workspace Name", #"Dataset Name", [Query="select * from $SYSTEM.TMSCHEMA_ROLE_MEMBERSHIPS", Implementation="2.0"])
in
#"Role Memberships"

• The report still provides data for queries against $SYSTEM.TMSCHEMA_ROLES and $SYSTEM.TMSCHEMA_TABLE_PERMISSIONS, e.g
• RLS is still enforced and visible via SSMS/Tabular Editor/Power BI service/etc. 
• The non-production instance of the semantic model still provides data for $SYSTEM.TMSCHEMA_ROLE_MEMBERSHIPS

Does anybody have any ideas? A complete rebuild/reload would be a fairly hefty undertaking so I'm trying to avoid.

Or is this going to be another MS ticket?

[Marius94]

We are facing the same issue. Did you find a way to solve the problem?

[v-xiandat-msft]

Hi @hinin ,

there are a couple of avenues we can explore to address this issue without resorting to a complete rebuild or reload of your semantic model:

1. Check for Recent Changes: Since you mentioned that this issue has arisen recently, it would be beneficial to review any changes made to the semantic model or the environment. This includes updates to Power BI service, changes in the deployment pipeline, or modifications to the model itself. Sometimes, even minor changes can have unexpected impacts on system queries.

2. Validate Model Compatibility and Settings: Ensure that your semantic model and the Power BI environment are fully compatible with the latest updates and features. Specifically, verify if there have been any updates or changes in how Power BI handles system queries for semantic models with RLS. The documentation on [Row-Level Security (RLS) permissions in Power BI](https://learn.microsoft.com/en-us/power-bi/developer/embedded/generate-embed-token) and [Power BI implementation planning for security](https://learn.microsoft.com/en-us/power-bi/guidance/powerbi-implementation-planning-security-report-...) might provide some insights into any recent changes or requirements.

Best Regards,

Xianda Tang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[hinin]

Unforunately this doesn't help.

1. None of the changes seem relevant. Per the initial description (although with some clarification), the definition is identical (including metadata) to that in non-production, and that is still functioning fine.
2. See above- the exact same model functions perfectly fine in the Test part (workspace) of the Deployment Pipeline, even if directed to pull data off Production datasets, so environments are the "same", albeit functional in one instance and not in the other. 

On a direct model-model comparison, the only differences are the id GUID, the RLS member entries, and a couple of Parameter values.

It's not a new model, and any recent changes have largely been very well understood (such as adjusting a measure's filters or redirecting to pull an incidental lookup table from a different data source) and should not impact the RLS.