Report security: Viewers to only see report content they have access to

[Oz]

Good morning all.  I'm new to Power BI and really hoping you can help me to understand security around Power BI reports, in particular not exposing data which the report viewer doesn't have access to.

Here's the scenario:

• We've built a Power BI report which uses data from a SharePoint list.
• The SharePoint List contains a folder for each project.
• All list items are inside the folder for the project to which they relate.
• Project team members can only access folders for projects they're working on, not any others.
• Senior management and our Programme Management Office (PMO) can access all folders.

What I'd like to do:

• Have a single Power BI report which can be shared with everyone in the organisation.
• Have a filter (slicer) on the report to allow users to select an individual project.
• Senior management & PMO to be able to see the results for all projects.
• Individual project team members to only be able to see results for project folders they have access to.

I've already built the report and it looks exactly how I want it to.  However, when I share it, others see what I see, even if they don't have access to all the folders.

I'm sure this is possible, but there's numerous options when setting up the security and authentication so I want to make sure I understand how they work and how to get the report to function as required.  I really hope that you can all help as this will make project reporting so much quicker and easier.  Thanks, Oz

[amitchandak · Accepted solution]

@Oz , To me, seems like a case of RLS, Row-level security

https://community.powerbi.com/t5/MBAS-Gallery/Microsoft-Power-BI-Unleash-row-level-security-patterns...
https://radacad.com/dynamic-row-level-security-with-organizational-hierarchy-power-bi
https://www.blue-granite.com/blog/using-dynamic-row-level-security-with-organizational-hierarchies

You have some ways to restrict report, refer

https://www.fourmoo.com/2020/05/26/did-you-know-you-can-now-selectively-show-report-pages-for-specif...

[Oz]

So, a quick update as this is now solved, thanks to the input from all of te respondees.  As we've only got about 15 folders to manage we decided to set this up with a role for each project and then adding users to those roles.  It was much easier than expected and works perfectly!  One key learning point is that RLS only applies to Viewers of the report.  As the workspace is linked to a Microsoft Team (and therefore Group), evereyone with access to that Team was automatically included as a Member.  Once the membership group had been changed to Viewer it worked great.

Thanks for all your help everyone - what a fantastic community!

[Sumanth_23 · Accepted solution]

hi @Oz - There are 2 approaches to solving this - both using RLS

1. You can create a table with the required security at project level and include it in your data model - so User access is driven by the security setup in this table 

2. Create roles based on the project level access and assign folks to roles so they will see data as per the role they are assigned to. Step by step methodology is show in this Microsft documentation 

https://docs.microsoft.com/en-us/power-bi/admin/service-admin-rls

Note: You need maintain these roles and access to the same - new role for new projects etc. 

Please mark the post as a solution and provide a 👍 if my comment helped with solving your issue. Thanks!

[Icey]

Hi @Oz ,

Please let me know whether you have solved this problem.

If you have solved, please always accept the replies making sense as solution to your question so that people who may have the same question can get the solution directly.

Best Regards,

Icey

[amitchandak · Accepted solution]

@Oz , To me, seems like a case of RLS, Row-level security

https://community.powerbi.com/t5/MBAS-Gallery/Microsoft-Power-BI-Unleash-row-level-security-patterns...
https://radacad.com/dynamic-row-level-security-with-organizational-hierarchy-power-bi
https://www.blue-granite.com/blog/using-dynamic-row-level-security-with-organizational-hierarchies

You have some ways to restrict report, refer

https://www.fourmoo.com/2020/05/26/did-you-know-you-can-now-selectively-show-report-pages-for-specif...

[Greg_Deckler]

@Oz I could be wrong but it sounds like you need row level security (RLS). You could make it dynamic or create lots of roles. https://community.powerbi.com/t5/Quick-Measures-Gallery/Dynamic-Hierarchical-Row-Level-Security/m-p/...

@ me if you need more information.

[Oz]

Thanks @Greg_Deckler and @amitchandak.  Sounds like this is rather more complicated than I was hoping so we'll take a look into row level security and decide how best to progress.  I really appreciate the prompt response as the report is going to save everyone a lot of effort and remove duplication.