RLS works in SSAS but doesn't work in Power BI service

[Anonymous]

Hi,

Please help with the issue.

We have created report with Live connection to tabular SSAS. 

Have set roles in SSAS. Roles work perfectly in Excel cube.

However in the published to PBI service report roles do not work. Users can see all the information in the report.

There is on-premisses gateway. I have inserted username() and and userprincipalname() measures to report. And I'm confused to see it returns gateway user information. Is it possible that gateway doesn't pass effective user accounts to SSAS?

Where else the problem could be? Any ideas? 

Update: RLS in the report do work, if I choose EffectiveUserName as Map use names option but only for external users. In this case all the users, that are in local server domain gets error, that report coudn't access the data source. External users see the report and only the data that is permited by RLS.

Usually, for local user reports we set CustomData option and remapp local users from email to domain\username. But remapping doesnt work with Effective option. And with Custom option all users see unrestricted data..

[v-zhangti]

Hi, @Anonymous 

If you import data from SSAS into Power BI Desktop, you can define roles and rules in Power BI Desktop and then validate the role within Power BI Service. If you are using a live connection to SSAS, you won't be able to configure RLS within Power BI Service. It is defined within the SSAS model on-premises.

For further information, you may refer to the following links.

https://docs.microsoft.com/en-us/power-bi/desktop-tutorial-row-level-security-onprem-ssas-tabular

https://docs.microsoft.com/en-us/power-bi/service-admin-rls

Best Regards,

Community Support Team _Charlotte

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.