Restrict Dynamic RLS for some users?

[Anmolgan]

I can use dynamic RLS ( USERPRINCIPALNAME()), if I have all the details of the email id's that I want to restrict, but for example if i have some users which do not have there emails present in the dataset, and i want to restrict them to a static role, such as if they login they should see specific amount of information can I do that?

How can I give full access to some users over dynamic RLS?

[V-pazhen-msft · Accepted solution]

@Anmolgan 

1. You could create a  new role for the static roles you want the specific users to see, then assign their account to the new role instead of the dynamic role filtered using USERPRINCIPALNAME(). 

2. To give the full access to someone over RLS, you could change the user's workspace role or give the user edit permission to the dataset. Because RLS only restricts users who can only view the reports. See: https://docs.microsoft.com/en-us/power-bi/service-new-workspaces#roles-in-the-new-workspaces

Best regards

Paul Zheng

[Anmolgan]

@V-pazhen-msft So I give the users edit permission on my workspace they can view the full content? regardless of the Dynamic RLS?

[V-pazhen-msft]

@Anmolgan 

Yes, we have made tests on that and you can also find it here:

scroll down to Using RLS with workspaces in Power BI:  https://docs.microsoft.com/en-us/power-bi/service-admin-rls

Paul Zheng

[Anmolgan]

@V-pazhen-msft  This says "If you have configured the workspace so that members have edit permissions, the RLS roles will not be applied to them. Users will be able to see all of the data."

So if I already configure the workspace as edit permissions, then dynamic RLS will never be applied?

Is that correct?

[V-pazhen-msft]

@Anmolgan 

Yes, it is right. Just remember RLS will not applied if any user has edit permission,  they can see everything on the report. 

Paul