Power BI Service - Security Cache

[kestlr01]

We appear to be having an issue with Power BI Service whenever a user's security is updated. We are using RLS on a report. Here is the scenario...

1. User opens the report in the browser and has access to X, Y, & Z.

2. User security is updated to Z Only.

3. User opens the report and still sees X, Y, & Z.

Does this happen because of the browser cache or because of Power BI Data cache? How are we able to have this cache cleared/updated to the latest security?

[V-lianl-msft]

Hi @kestlr01 ,

1. Please check whether the user is a viewer of this workspace.

2. What you need to know is that RLS is applied to datasets.When you modify RLS in desktop, please refresh the dataset in service so that RLS can take effect.

Best Regards,
Liang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anand24]

Hi @kestlr01 ,

Can you please make sure the user is assigned "viewer" role in the workspace?

RLS works only with viewer role/permission.

Give a thumbs up if this post helped you in any way and mark this post as solution if it solved your query !!!

[Anand24]

Give a thumbs up if this post helped you in any way and mark this post as solution if it solved your query !!!

[kestlr01]

@Anand24 I guess I don't quite understand and maybe I should have mentioned this in the original post. We then publish this report as an app and assign the users access to the app. Only a few users have access to the workspace and the majority of report/APP users/viewers obtain it through the app.

It is my understanding that the browser doesn't record any information as it relates to reports in Power BI Service based on this from the security white paper...

Do clients cache web page data locally?

When browser clients access Power BI, the Power BI web servers set the Cache-Control directive to no-store. The no-store      directive instructs browsers not to cache the web page being viewed by the user, and not to store the web page in the client's cache folder.

So, it is very confusing as to why we would be seeing this behavior.

[Anand24]

Hi @kestlr01 ,

What role does the user on whom RLS is applied have on the workspace?

Can you check if they have the below role is assigned:

Give a thumbs up if this post helped you in any way and mark this post as solution if it solved your query !!!

[Anand24]

Give a thumbs up if this post helped you in any way and mark this post as solution if it solved your query !!!

[kestlr01]

@Anand24  We are enforcing RLS by publishing an app and dstributing it to users. You don't have to give access to the workspace to enable RLS.

[V-lianl-msft]

Hi @kestlr01 ,

Is this problem sloved?
If not, please let me know.

Best Regards,
Liang
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.