Issue with Row Level Security

[Anonymous]

Hello,

I have an issue in setting up a raw level security for my report. In my report I want to set a raw level security so each company can only see its sales in the report. Therefore, I created a raw level security from the Manage roles section under Modeling in Power BI Desktop, using the field "Company" and then authurised in Power BI service the related accounts to each role. The Company RLS worked fine.

The problem is when I want to apply a Raw Level Security for Group of Companies reports. There I use the field Group of companies to control the access. When I saw this did not worked I also used the "Company" field  and I chose the Companies manually (i.e. Company="Company1"||Company="Company2"||Company="Company3") but this did not work either as Group of Companies reports are always accessible to all accounts, even to the accounts that do not have permissions to see these.

Can you please support in this?

Thanks!

[Anonymous · Accepted solution]

Thank you all for your recomendations. However, the only way to give solution to this issue is to create a Dynamic RLS that solves the problem.

[V-pazhen-msft]

@Anonymous ，

You can create three groups Company1, Company2, Company3 in the office365 group, place the users in the groups you want to see, and set them to Viewr, and then place the three groups created in the power bi service to the corresponding roles, so that users will view the specified data in the specified group.

If you want a user to be able to see everything, directly change the user role to Member.

Row-level security (RLS) with Power BI - Power BI | Microsoft Docs

Best Regards,

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[v-yangliu-msft]

Hi  @Anonymous ,

What sharing method do you use to give content to them.

The role in the workspace must be Viewer, otherwise RLS has no effect.

https://docs.microsoft.com/en-us/power-bi/admin/service-admin-rls#using-rls-with-workspaces-in-power-bi

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous]

@v-yangliu-msft ,

The role of the users in the workspace is viewer. Also I forfot to mention that the sharing is done through the workspace app if this helps to find the issue.

Thanks!

[v-yangliu-msft]

Hi  @Anonymous ,

Check whether there is a logical conflict between the new RLS expression relationship you created and the old RLS expression relationship.

For example, if a user has a condition, adding to another condition causes the user to exist in multiple roles, then these roles will conflict.

Best Regards,

Liu Yang

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous]

Hi @v-yangliu-msft thanks for your response. I checked for conflicts and I can confirm that there are no conflicts in these roles. I can see this after a check I did in our test environment when I leave only one role (so no chances for role conflicts) the issue still exists i.e. The RLS does not apply to the Group of Companies fields. 

[blopez11]

It would be easier to provide help if you could send screenshots of the following:

- your model, as it pertains to RLS

- roles setup in Power BI Desktop, showing role name and table

- DAX expression setup for each role

Thanks,

[Anonymous]

Hello @blopez11,

Thanks for your response, unfortunately I cannot provide any screenshots I can however provide some of the information you require.

Regarding DAX expression and table names for each role:

I have settled static RLS assigning the roles using the Company name field (i.e. Role1: Company Name="Company1" gained from Companies table. This works fine. When I go for group of companies I create a similar role (i.e. Group of Companies Name="Group of Companies1" gained from Group of companies table, but this does not work as everybody with no access can still see this group of companies.

Regarding the model please see below the structure