Tabular model RLS in Power BI

[mapko]

All,

I am constantly failing in my attempts in trying to get RLS work in my PBI file that is based off a tabular model. In the tabular model I have define a role and when I analyze the data in XLS I get a desired outcome. But once I load the same model in PBI, I see complete dataset.

Can you please let me know what step I am missing?

Thank you!

[Seth_C_Bauer]

@mapko It sounds like you are using SSAS Tabular model, and connecting to it from the Desktop. If that is the case, I feel your pain. I'm not aware of a way to use a live connection and "view as" a certain user in the Desktop. I've always had to either verify things in the Tabular mode with the "view as role" in Excel, or deploy the reports to a test workspace, share with a few users, and verify that my RLS is working as expected.

[mapko]

@Seth_C_Bauer, thank you for your response. I've tried your approach and not even that works. Indeed, I use the tabular model in connection with the desktop client but the SSRS version of the dektrop client and I save my work directly onto the reporting service. It is an odd behaviour since the analyze in XLS preview works as expected. 

[Seth_C_Bauer]

@mapko Are you using Import or live connection to the Tabular model? And it sounds like your using the latest SSRS bits, so your using their version of the Desktop and publishing or deploying that to the SSRS server - yes?

[mapko]

@Seth_C_Bauer I am using live connection and yes, I am using the PBI SSRS desktop version to save the report on the SSRS server. Out of curiosity, I changed the connection to Import and under Modelling ribbon sectin I can access both Security settings but the role I defined in the tabular model is not present there. Thank you for your assistance. Am I missing something else here?

[Seth_C_Bauer]

@mapko The role wouldn't be there if you imported, and you wouldn't have RLS, you would have to recreate it in the Desktop file. (which is why I asked).

Is the user you are sharing with an admin on the server, or somehow have elevated permissions that would override any RLS setting?

I'm also assuming you are looking users up by their <domain>\<username>

I don't see anything that would lead me to believe this wouldn't be supported...

[mapko]

@Seth_C_Bauer, quite frankly I was testing this wiht my own account. I limited the data to only one location, our of a dozen. I am an admin on the server but I am thinking that shouldn't really clash with RLS setting applied to my report. Yes, I am looking up users by the domain. Have only one. Even created a measure [USERNAME()] to verify correct username is parsed through the tool. All checks out.

[Seth_C_Bauer]

@mapko See this post for a quick check.

In my experiance, as an admin of the tabular model Power BI will always show me everything. I have always needed to share the report with an end user that should be filtered in order to confirm that the RLS was working as expected in the reports.

[mapko]

@Seth_C_Bauer, thanks. I asked my IT department to create a non-admin account for me for testing purposes. The solution to the issue in the post you shared did not do the trick. Fingers crossed non-admin account helps.

[v-qiuyu-msft]

Hi @mapko,

As you connect to SSAS tabular in live connection, it will apply the role which defined on SSAS side. But as you are server administrator, row filters do not apply. All data can be queried in this role. See: Roles.

Best Regards,
Qiuyun Yu

[rkri000]

Hi 

anyone got any luck using rls in tabular models for powerbi report server. I got the same issue and everything works fine in excel

I connect via credentials and impersonation and  haven't setup kerberos authentication as this shouldn't be necessary.

I woould just like to know if it has been diabled on purpose or if it is an error we can expect to be soved. 

/rkri

[mapko]

@rkri000, how are you testing this on the report server? If with your own account (that also has admin priviledges on the analysis service instance) then RLS will not work. The moment I removed myself from the instance's admin role RLS worked.

[rkri000]

@mapko

Thanks it helped. I have forgotten to turn if of for the test users. The behaviour is a little different than usual.. The test user gets a an error. The permission granted to user ----- are insuffient for performing this operation. But that is okay

Thanks 

/rkri000