Connecting to powerbi dataset with existing RLS

[m4amin]

Hello,

I am stuck in a scenario that I hope someone with more knowledge can help.

I have created a powerbi dataset file (this only has roles, there is no facttable here) with dynamic RLS and published to powerbi service (Let's call this file SET1). 

I have another powerbi file where i  have imported a new facttable, and connected to SET1 as direct query. One of the tables of SET1 filters the new imported facttable (Let's call this file SET2).

When I publish SET2 to powerbi service, the RLS from SET1 does NOT filter through to the facttable and the end user is able to see ALL DATA in the facttable.

What am I doing wrong? I want them to see only regions they have access to in SET2 based on their role created in SET1.

Any help would be nice :). Thank you in advance.

[TomMartens]

Hey @m4amin ,

I'm wondering if you are publishing SET2 to the same workspace that hosts SET1.

Users that have to access do need build permission on SET1, this is necessary (at least for the moment) as SET1 forms a composite model with the tables of SET2. The users have to be either a member of the workspace that hosts SET2 or need access to app used to share the content.

Hopefully, this helps to tackle your challenge.

Regards,

Tom 

[m4amin]

Thank you @lbendlin . My SET1 filters ONLY SET2. And the filter is working on a report.

The only problem I am facing and I tested this multiple times is that I HAVE TO share the SET1 dataset with the end user or else he/she won't be able to see the filtered report.

I don't want to share SET1 and SET2 datasets but rather let the dynmaic RLS configured on SET1 to recognize the end user then filter SET2 facttable in any reports.

Is this possible without sharing SET1 dataset?

[lbendlin]

No, it is not.

[lbendlin]

When you link the dataset data models you need to make sure that the link goes ONLY from Set1 to Set2. Any bidirectional connection will negate the RLS. 

There are also unintended side effects when you give users access to your Set2 dataset that have access to Set1 but are not member of any roles.