Row level security on dataset

[Anonymous]

Recently I have the issue that when I add someone to a role in the Power BI service, that I need to add that person as "Reader" in the manage permissions screen of the specific dataset. This step was never necessary.  

[v-qiuyu-msft]

Hi @Anonymous, 

In your scenario, which method do you use to share the report with client user? 

Based on my test, define a RLS role and publish the report from Power BI desktop to desktop, go to Security section of the dataset to add a user as a member of this RLS role. Assume this user doesn't have any access to the workspace which contains the report, we need to share the report so the  user can view report, eg: via Share button. The share feature is adding the user as a Read role on the dataset automatically, we needn't to assign read role manually. 

Reference: 

https://docs.microsoft.com/en-us/power-bi/service-share-dashboards#troubleshoot-sharing

Best Regards,
Qiuyun Yu

[Anonymous]

Hi Qiuyun,

I add the user to a role on the dataset, then I build a report based on that dataset (the dataset is in another workspace) and publish an app (with that user given permissions to the app).

Best regards,

Mark Filippo

[v-qiuyu-msft]

Hi @Anonymous, 

Please take a look at this limitation listed in this document: 

"As an app publisher you have to make sure that your audience has access to datasets outside of the workspace. Otherwise, users will encounter issues when interacting with your app: reports won’t open without dataset access, and dashboard tiles will show as locked. Also, users won’t be able to open the app if the first item in its navigation is a report without access to the dataset."

Best Regards,
Qiuyun Yu 

[Anonymous]

The issue is that in some cases when I add a user to a role in the dataset, I also need to give them 'reader' permissions when I use 'Manage permissions' on the same dataset. I expect that to go automatically (which happens in most cases). 

[v-qiuyu-msft]

Hi @Anonymous, 

When you share the report or dashboard related to this dataset, the shared user will be grant view permission on the dataset automatically. So after you add the user as RLS role member, you can share the report based on this dataset via Share button, then go to Manage Permission, you will find the shared user is in the list. 

Best Regards,
Qiuyun Yu 

[Anonymous]

"the shared user will be grant view permission on the dataset automatically" - The issue is, that this didn't happen automatically. I added the user to the a role in the dataset and gave the user permissions to an app that contained reports based on this dataset. He received the error that he didn't have access to the dataset.

So I needed to add the user manually in the manage permissions screen. This happened for multiple users (but not all of them)

[v-qiuyu-msft]

Hi @Anonymous, 

I would suggest you create a support ticket to get help. 

Best Regards,
Qiuyun Yu

[Anonymous]

Okay, will do. Thanks for your help!