Don't allow workspace users to download dataset (due to RLS)

[chrispybacon]

Hi all 🤖,

currently we are thinking about implementing a SSBI solution. 

For the datasets we have RLS in place, so preparably I wouldn't want the users to be able to dowload the dataset, because then the dataset will be "unfiltered". 

When adding the build permission on the dataset, are the users assigned to the workspace only able to work on the dataset without having the option to download the file? Are there any other settings that need to be considered (i.e.underlying data option)?

GOAL: We will be providing all the measures, and the users should only work on the drag and drop part on the web interface with RLS active. 

Best regards,

Christian 

[v-shex-msft]

Hi @chrispybacon ,

AFAIK, download pbix feature requirement edit permission and RLS require read permission.  So I think you only need to assign view permission to your users to enable the RLS effect and them not able to download pbix file. (For users who enable RLS filter on the dataset without edit permission, they can only export filtered records)

Download a report from the Power BI service to Power BI Desktop (Preview)#considerations-and-trouble... 

Row-level security (RLS) with Power BI#using-rls-with-workspaces-in-power-bi 

BTW, you can manage export features on power bi admin portal. (it works on turn on the whole organization) 

Administering Power BI in the admin portal#tenant-settings 
Regards,

Xiaoxin Sheng

[chrispybacon]

Hi @v-shex-msft,

ok I understand that. RLS works with the view permission. But my goal is that the user sees the sectioned data (RLS active) and can create reports on that in the Power BI Service. For that they would at least require the contributor role in the workspace, which automatically gives the user build permissions, right? That way the RLS would not work anymore. 

The alternative I see, is uploading multiple filtered datasets and removing individual permissions from them, while giving all the users in the workspace the contributor role. Sorry I don't have people to test it with, which is why I am asking. 

Is that a feasible workaround? 

Best regards,

Christian

[v-shex-msft · Accepted solution]

Hi @chrispybacon ,

Maybe you can refer to below steps to use two workspace to manage different functions:

1. Publish your report and dataset to workspace A that has edit permissions.
2. Copy your report(above step) to workspace B and only give these contents view permissions. (notice: turn off build premises option and remove edit permission in dataset permission manage)

Then you can assign users to different workspaces to achieve accurate control. (workspace A: edit and download data, workspace B: view and RLS filter)

Regards,

Xiaoxin Sheng