cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
BBCF
Frequent Visitor

Build permission not working

Hello Community,

 

I am testing a self-service scenario with RLS. I have published a report and dataset with RLS and gave below access to users:

  • Workspace - viewer
  • Dataset - viewer, build

Now users are able to display reports with correct permission according to RLS, but they are not seeing the dataset in the service and are not able to create their own reports using it. In accordance to this document it should be now possible.

 

Do you have any solutions for it? Maybe I did miss some steps?

1 ACCEPTED SOLUTION
v-robertq-msft
Community Support
Community Support

Hi, @BBCF 

From my point of view, I still believe that the end-user can not both have build permission to this dataset and RLS worked on him. These two cases tell the similar thing about my opinion:

https://community.powerbi.com/t5/Service/Can-t-Get-RLS-to-Work/m-p/46964

https://community.powerbi.com/t5/Service/Row-level-security-does-not-apply-to-viewer-role-with-datas...

But it’s very weird that the end-user can’t find the dataset when the report and build permission are shared to him. Because I can find the dataset and the report when I tested the sharing with build permission using the end-user account:

v-robertq-msft_0-1611024028983.png

 

v-robertq-msft_1-1611024028988.png

 

If you still want to make the end-user have both build permission to this dataset and RLS worked on him. I suggest you to go to open a support ticket and ask the technical support team for possiblity of solution of this problem.

https://community.powerbi.com/t5/Community-Blog/How-to-create-a-support-ticket-in-Power-BI/ba-p/6830...

https://powerbi.microsoft.com/en-us/support/

 

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

View solution in original post

14 REPLIES 14
BBCF
Frequent Visitor

Thank you @v-robertq-msft for your support and all proposed solutions. I will pass this issue to the technical support.

 

Best regards

v-robertq-msft
Community Support
Community Support

Hi, @BBCF 

From my point of view, I still believe that the end-user can not both have build permission to this dataset and RLS worked on him. These two cases tell the similar thing about my opinion:

https://community.powerbi.com/t5/Service/Can-t-Get-RLS-to-Work/m-p/46964

https://community.powerbi.com/t5/Service/Row-level-security-does-not-apply-to-viewer-role-with-datas...

But it’s very weird that the end-user can’t find the dataset when the report and build permission are shared to him. Because I can find the dataset and the report when I tested the sharing with build permission using the end-user account:

v-robertq-msft_0-1611024028983.png

 

v-robertq-msft_1-1611024028988.png

 

If you still want to make the end-user have both build permission to this dataset and RLS worked on him. I suggest you to go to open a support ticket and ask the technical support team for possiblity of solution of this problem.

https://community.powerbi.com/t5/Community-Blog/How-to-create-a-support-ticket-in-Power-BI/ba-p/6830...

https://powerbi.microsoft.com/en-us/support/

 

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

View solution in original post

BBCF
Frequent Visitor

Thank you @v-robertq-msft but none of those solution works for us. User simply cannot see the dataset using any of above approaches both with or without Viewer access role. It is only accessible if user is an Member or Contributor, but then it disables the RLS.

v-robertq-msft
Community Support
Community Support

Hi, @BBCF 

Has the end-user opened the link or email you shared with him?

v-robertq-msft_0-1610934974218.png

If the end-user can not see the dataset, you can also check if he can find the shared report in the “Shared with me”?

v-robertq-msft_1-1610934974278.png

You can also go to the “Get data”->” Published dataset” to check if he can find the shared dataset.

v-robertq-msft_2-1610934974303.png

One last thing, have you removed the end-user's “Viewer” access to your workspace? Because this “Viewer” access will keep him away from the dataset.

 

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

BBCF
Frequent Visitor

Hello @v-robertq-msft 

 

I did as you suggested, and the user is still not able to see the dataset:

 

Przechwytywanie-build.PNG

 

Przechwytywanie-datasets.PNG

v-robertq-msft
Community Support
Community Support

Hi, @BBCF 

I’ve read the document you posted. Here’s my understanding of the Build permission for shared datasets:

When you add the user to your dataset with build permission, then they can get access to the dataset and build reports. When you add the user to the workspace with Member or contributor, of course, they can access all the content in the workspace, including the dataset. However, when you add the user to the workspace with the Viewer role, then the user can not access any dataset within the workspace even if they have been given the build permission. Because the priority of the viewer role is higher than the build permission. This is also the original purpose of creating the role of the viewer. You can check this document:

v-robertq-msft_0-1610527789114.png

Document link:

https://powerbi.microsoft.com/en-us/blog/announcing-the-new-viewer-role-for-power-bi-workspaces/

 

My suggestion is to remove the user from the workspace and share the report to him with the build permission, like this:

v-robertq-msft_1-1610527789135.png

And the end-user can find the dataset and create reports here:

v-robertq-msft_2-1610527789145.png

 

 

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

v-robertq-msft
Community Support
Community Support

Hi, @BBCF 

According to your description, you said the users are able to display reports with correct permission according to RLS. One thing you should keep in mind: The RLS can only work for the users that have only view permission to the dataset. Therefore, I don’t think that the users have been given the build permission of the dataset.

What’s more, the viewer in the new workspace is not able to edit any content in the workspace. In my opinion, you have to choose one thing between RLS and build permission for the users. Once the RLS works on them, they won’t have the build permission. Once the build permission is given, they won’t be restricted with RLS.

I suggest you to promote the users to the “Member” of the workspace so that they can find the dataset and create reports in Power BI Service.

Roles in Power BI new workspace

More info about RLS in Power BI

 

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Thank you Robert.

 

According to the document that you linked Roles in Power BI new workspace Build permission should give the user the right to create content over a shared dataset. If only Member or Contributor should have this possibility, why this option is grantable also to Viewers? Please see the quote below:

 

To copy a report, and to create a report in another workspace based on a dataset in this workspace, you need Build permission for the dataset. For datasets in this workspace, the people with Admin, Member, and Contributor roles automatically have Build permission through their workspace role.

 

Also, from what you said I understand that giving Build permission should revoke RLS for that user and give them possibility to build content - and suprisingly, for me it is working in the oppisite way. RLS is still in place, but there is still no way to access the dataset in order to create new report. In order check that, I disabled RLS and users (Viewers with Build permission) are still not able to create a report using the dataset. Maybe this is just an inconsistency between the documentation and how actually the Service works?

Hi, @BBCF 

I don’t think users’ access to the dataset is related to the existence of RLS. It’s only about permission given.

What’s more, RLS can always work on the viewers of the workspace in my opinion.

Would you like to try to change the users’ role to Member or contributor in the workspace and check if they can build reports using this dataset?

 

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

HI @v-robertq-msft,

Thanks for your response. I agree that RLS is not the case - that was my point, despite the RLS on/off Viewers with build can not create reports.

 

I have checked other access levels and this is how it looks:

  • Member - can create a report / RLS does not apply
  • Contributor - can create a report / RLS does not apply
  • Viewer with Build - can not create a report / RLS applies

Hi, @BBCF 

The test result is the same as I expected.😁 Thank you for your understanding and detailed experiment for each role in the workspace, which can also help other community members a lot. Would you like to accept your own reply as a solution so that other community members can learn from this too?

Thank you very much!

How to Get Your Question Answered Quickly 

 

Best Regards,

Community Support Team _Robert Qin

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

Hello,

 

I still do not see any solution. From what I understand from Build permission for shared datasets document, Viewer with Build permission should be able to create reports - my post only proves that in my case it is not working that way. Either the documentation is misleading, or I am not getting it right. Could you please advise?

 

PBI2.PNG

 

 

StefanoGrimaldi
Solution Sage
Solution Sage

yes you have 2 way for this: 

1) on the siervice you can go to get data and get company content datasets: 

StefanoGrimaldi_1-1610020602245.png

StefanoGrimaldi_2-1610020635224.png

 

2) open a power bi desktop file and new source use a power bi dataset as source. 

 

aslo read: https://docs.microsoft.com/en-us/power-bi/connect-data/service-datasets-across-workspaces 

 

if this solved your question please mark as solution for others to find it more easily, and if you liked the solution give some kudos. 

Thank you for your answer.

Unfortunately, data set is not visible in the list of published data sources.

Do you have any other ideas?

Helpful resources

Announcements
PBI User Groups

Welcome to the User Group Public Preview

Check out new user group experience and if you are a leader please create your group!

MBAS on Demand

Microsoft Business Applications Summit sessions

On-demand access to all the great content presented by the product teams and community members! #MSBizAppsSummit #CommunityRocks

MBAS Attendee Badge

Claim Your Badge & Digital Swag!

Check out how to claim yours today!

secondImage

Are You Ready?

Test your skills now with the Cloud Skills Challenge.

Top Solution Authors
Top Kudoed Authors