RLS does not work in Power BI

[matdub40]

I have a database stored in SSMS Analysis Services that feeds a Power BI file that is located in app.powerbi.com.
This report shows sales by region, I would like to give store employees access to this report but have them only see sales from their own store.

For this I added a table Y2_StoreEmployee with the store number and the store email and linked it to the table Y2_Store :

I created a Stores role in read mode and I put as formula DAX =Y2_StoreEmployee[email]=USERPRINCIPALNAME() in the Y2_StoreEmployee table.

I have a group in Azure that allows me to add the emails and give them access to the application and thus to the report.
However, when I connect with an email address of a store I still have access to all the data, is there a parameter that is missing? I did follow the Microsoft documentation.

Thank you for your help

[ibarrau · Accepted solution]

Hi there. I can think two things. First be sure that the role you have created it only has the "reader" box checked. Second the users with rls can only be Viewers at power bi workspace. If one of those two have more privileges, then they will see it all.

Just to clarify, the users can't be Analysis Services Server Admins or they will see it all again.

I hope that helps,

[matdub40]

Thank you very much for your answer! @ibarrau 
Indeed, the members of the BI group in Azure were owners of the workspace so they could see everything.
I just made the change by putting the email as the workspace viewer and it works!

What is the best thing to do because there is the workspace, the application and in this application my Power BI report which must be filtered. Where should the viewer permission be put?

Maybe add them as a reader of the report and send them the link?