Power BI Embedded and Pro, SharePoint Online, Guess access and RLS

[Anonymous]

So we have a scenario where we want to use Power Bi Embedded to share reports with guests (External users) on SharePoint Online.

What we have setup,

- O365 Group, let's call it "Client ABC", this has a corresponding team on Teams, SharePoint Team Site and Power BI Workspace.

- Added the guest user (tom@client.com) to the "Client ABC" group. Tom has a Power BI Pro license.

- Embedded our report on a modern page in SPO

- Dedicated Power BI Embedded capacity to "Client ABC" workspace

- Setup some RLS rules on our report

Now my queries,

1. Tom is able to view the report on SPO, but the RLS doesn't seem to be applying, what am I doing wrong?

2. Will Tom be able to access the report and "Client ABC" workspace on Power BI? I ask this because until query 1 is sorted, we have to use filters as a means for security (Which isn't prescribed).

[v-yulgu-msft]

Hi @Anonymous,

---

 Now my queries,

1. Tom is able to view the report on SPO, but the RLS doesn't seem to be applying, what am I doing wrong?

2. Will Tom be able to access the report and "Client ABC" workspace on Power BI? 

---

1. Did you add Tom to corresponding Role? Unable to test RLS with guest user

2. External B2B guests are limited to consumption of content only. They can't access the workspace on Power BI.

Best regards,

Yuliana Gu

[Anonymous]

Hi @v-yulgu-msft,

1. I did add him to the corresponding role. When testing, as a member of the role, RLS is aplplied; however when testing as Tom, RLS is not applied. Could this perhaps be because Tom is part of "Client ABC" group and thus having access to the complete dataset? AFAIK, this is required for Tom to be able to see the embedded report, right?

2. That will definitely help us secure access to data, however it would be nice if we could use RLS as well.

Thanks

Mohit Garg

[Anonymous]

On the report I have setup a role, "Client ABC". In Power Bi Online, when I test,

1. As "Client ABC" role, RLS rules are applied

2. As "tom@client.com", RLS rules are not applied

Anyone able to help why this is happening?

[Anonymous]

After a frustrating day, my conclusions is: RLS setup in Power BI is rendered useless when used with Power BI Embedded because of how Power BI Embedded works. For a user to access an embedded report in SharePoint (SP), they need to have access to the SP page and be part of the workspace the report belongs to. When a user becomes part of that workspace, they automatically gain Owner rights to the datasets in that workspace; and as a result have access to the complete dataset bypassing any RLS roles/rules applied.