RLS in Paginated Reports - User cannot view

[nigelreilly]

Hi,

I have a dataset in Power BI which has RLS rules within in it. The RLS works fine for users.

I have now created a connection to that Power BI dataset within Paginated reports. When I publish my Paginated Report to the Power BI app (the same app with the desktop rls report) the user under the RLS can not open it. I am able to run the report as I am a member of the workspace therefore RLS is ignored. The user is a member of the published App.

This is the error they see: Can anyone help?

[chrisfin · Accepted solution]

Make sure you provide Build permission to the users for the underlying dataset - https://docs.microsoft.com/en-us/power-bi/paginated-reports-embedded-data-source

[MallikarjunaBan]

Hi @ChrisP please share proper docs kindly as there are lots of examples with out an end please share help docs or let me know if rls can be achieved using power bi data set as a source and passing username to @userid when published to power bi service

[Anonymous]

@nigelreilly how did you resolve this? I am stuck in the same way. please suggest.

[chrisfin · Accepted solution]

FYI, we're shipping this week the changes to permissions to align paginated reports with Power BI reports for all scenarios.  Customers should no longer require "Build" permission when the items are in the same workspace or deployed in an app, and can use the new viewer role same as PBI reports can.  This will show up in tenants later this week or over the weekend.

Thanks!

[jochenj]

Hi @chrisfin  can you confirm that this feature has shipped?

For me the issue is as of today reproducable, i have to manually add app-users permissions to the dataset.

Just adding the paginated report to the app does not automatically give any dataset permissions to the recipients. Works only if i build a native PBI Report for this same dataset and add this report (hidden) to the app, after app publishing the app receivers then automatically added with "APP(..)" permissions...when i then remove the native pbi report from the app and republish...the user permissions on dataset switches to "Read,Build".

[chrisfin]

It has always been necessary to manage dataset permissions seperately with a paginated report, as there is no data model within the report itself like there is with Power BI report.  

[klinejordan]

We can also reproduce this issue as of yesterday - we have a dataset (with RLS) and a paginated report connected to that dataset all in the same workspace. Both objects are included in the app and build permission is granted through the app. Workspace members and admins cannot reproduce the issue but app consumers are getting the "error communicating with Analysis Services" error.

I assumed that the build permission to the dataset granted through the app would be sufficient for provisioning access but sounds like that may not be the case? Do we need to explicitly grant the build permission for the user group outside of the permissions granted through the app? 

[chrisfin]

Was this working before, and now is failing?  Or was it not working before?

Also, are you giving users build/reshare permission who access this through the app?

[klinejordan]

Not sure if it was working before to be honest, I'm not really on the team that owns the workspace I'm just relaying information as a tenant admin. 

The users do get reshare and build permission to the dataset via the app. Here's a screenshot of the dataset permissions (with some sensitive information removed)

[jochenj]

@klinejordan  the questions here is if you have the same scenario. what's included in your app? Only the paginated report? Or also a pbidesktop report which uses the same dataset as the paginated report?

[klinejordan]

@jochenj the source dataset for the Paginated Report also has a Power BI report in the same workspace that's included with the app.

@chrisfin just created a support ticket for this if that helps - 120100824004145

Thanks!

[jochenj]

hi @klinejordan  just wonder if you made progress with the ticket 120100824004145 ?

[klinejordan]

No Progress, had a call with a support engineer yesterday but that's it

[jochenj]

yes, that support cases usually takes some more time  😉

[chrisfin]

Great, thank you!

[jochenj]

no, never worked. I initially added the paginated report to the pbi app and thought user will have automatic permissions on the paginated reports dataset. Target is to only add app-users and not  NOT manage dataset permissions again/duplicated

I tested it again and can reproduce the behaviour:

- If the paginated reports (which uses dataset1) is added to app --> app-users have no permissions to access the report in the app

- If i add a "dummy" pbidesktop report (which uses dataset1) to the app and "hide" this report in navigation --> user has still no access to app-paginated report

- Only if i unhide the pbidesktop report in app-navigation new app users will get automatically the needed dataset permissions set to "App(Build)" or "App,Build" based on app-permissions-setting "app users can connect to the published report datasets..."

[chrisfin]

If you assign access to a user in the dataset directly through the workspace, and uncheck both boxes, you'll see they get "Read" permission.  If they get this through the app, they get something just labelled "App" permission when you look at the dataset.  I believe this is the issue - this is a change where they got Read either through the workspace or the app, so we're looking into this and will expedite a fix if this is the specific issue.

Chris

[jochenj]

thanks for this insight!  Ok, as long as the pbi service will not detect the datasets used by the paginated report i can workaround with a dummy pbi report using the same dataset and adding this as a hidden navigation entry in app...not perfect but works 😉

[Anonymous]

Hi,

We having the same issue. User with viewer role (free licence) and build permission isn't able to see the dataset. 

What did we do wrong?

Kind regards.

[Anonymous]

@Anonymous  Hi It worked for me. Let me know if you are still facing the issue.

[Anonymous]

Thanks for your help. The issue was caused by the capacity of our subscription.