Do accesses at the source affect RLS filters?

[Anonymous]

Hi All,

I've setup RLS which reads reader's e-mail address and filters data accordingly. All works well, especially when displaying as respective person in Power BI Desktop.

Yet, after I published the report and in dataset security added a global AD group things start to get weird - as for the most people RLS filter works well as for some it shows all the data. I've checked the membership of the abovementioned group but these people are found there so it isn't a thing (anyway, if someone would not be a member of the group he/she should see nothing, right?).

I noticed that the people having the filter-free view are people who have the access to the SharePoint library from which the data is collected (yet, with one exceptional person who sees - as designed - only respective data).

And here I got a question - could accesses at the data source override RLS? It would make sense logically but how would it happen in the Power BI Service?

Any answer will be much appreciated!

Rob

[v-angzheng-msft]

Thanks for your feedback😀. Could you please mark this thread as Answered since it is working now? It will help the others in the community find the solution easily if they face the same problem with you. Thank you.

[v-angzheng-msft]

Hi, @Anonymous 

Yes, access to the data source affects RLS filtering, if a user has access to the data source then RLS does not work, in other words, row level security only works for users with viewer privileges. If RLS does not work as expected, check if the workspace role permission is set to viewer.

Hope this helps.

Best Regards,
Community Support Team _ Zeon Zheng
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous · Accepted solution]

Hello @v-angzheng-msft,

Thank you for your response. I have already removed all accesses from the workspace and left the access on the app only. There must have been something stuck on cache or so, because I noticed that if I published the report on new workspace then everything works as designed... Must be some glitch

[Anonymous]

I realized there was a direct access added for the working group (a group from MS Teams) who have the access to the source data. Yet, even after removing this access they still can see all, unfiltered, data. When I check it on Power BI Desktop the behaviour is correct, so it's something with the Power BI Service...

I'd appreciate any support on this