Row Level Security LWS

[Anonymous]

Hi All,

We have implemented Dynamic Row Level Security in our report and published in app services but whenever the user is accessing the report ,he is able to see the entire data and not the restricted one which we have created as RLS in our report. The user can only see his data(restricted data) by applying security at the dataset. Do we have any option to implements RLS for the user without applying security at the dataset in power bi service ?

Thanks,

Raghu

[Greg_Deckler · Accepted solution]

@Anonymous You have to add the user into an RLS role at the dataset. With Dynamic RLS that is generally a role that implements a filter on a security table like [Email] = USERPRINCIPALNAME()

[Greg_Deckler · Accepted solution]

@Anonymous 

(1) Dynamic Hierarchical Row Level Security - Microsoft Power BI Community

So, you generally have a table like the following:

Email

gdeckler@gmail.com

hank@gmail.com

etc.

You create a Role (RLS role) and the role has an expression like:

[Email] = USERPRINCIPALNAME

Meaning that users in this Role can only see their own row. This row is then linked (related) to the rest of your data in your other tables meaning that only related rows to this single row are visible to the person in the RLS role.

You publish the dataset. Then, in the Security for the dataset in the Service you add users to this Role. Now, when they view reports based on the dataset, they only see their own information. Now, the caveat is that you do NOT want to add those users to the workspace because that overrides RLS.

[Anonymous]

HI Greg,

We have two tables Fact and User tables . Base on the Job id /Name we need to apply dynamic security roles and we don’t have email id column .  when apply relationship between these two tables on LCT_NBR column(common column) its getting many to many relationship . PF below sample data.

Can you please guide me how to avoid many to many  relationship and any DAX function available to apply roles ID columns?

Thanks,

Nath

[v-yanjiang-msft]

Hi @Anonymous ,

Both static and dynamic RLS are required to assign users to dataset security, this is an inevitable step.

For more detailed steps to apply dynamic RLS, refer to the this article: Dynamic Row Level Security with Power BI 

Best Regards,
Community Support Team _ kalyj

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Burningsuit · Accepted solution]

hi @Anonymous 

This is probabaly because of the access permission your users have in the Workspace. If they have Workspace access, either as Admin, Member or Contributor, they are not subject to RLS and will see ALL the data. Only Viewers are subject to RLS in the Workspace. This feeds through to Apps too. If they are Admin, Member or Contributor on the Workspace the App is built from they will see ALL the data in the App. Only Viewers, or users not given Workspace access are subject to RLS in the associated App.

Remove the users access to the Workspace and they will be subject to RLS in the App.

Hope this helps

Stuart

[Anonymous]

HI Team,

Basically every user  having Job ID so based on the JOB id user will see their own data in power bi app service.

I need to apply  dynamic row level security  on the  job id level which is highlighted in yellow color .kindly help which DAX function we can use to see their own data and normally if user name we can use UserPrincipalName function.

Below is the sample data .

Thanks,

Raghu

[Anonymous]

Hi Greg. 

I am not able to understand  your response . can you please elaborate and if you have any Urls related to RLS please  add.

Thanks,

Raghu

[Greg_Deckler · Accepted solution]

@Anonymous 

(1) Dynamic Hierarchical Row Level Security - Microsoft Power BI Community

So, you generally have a table like the following:

Email

gdeckler@gmail.com

hank@gmail.com

etc.

You create a Role (RLS role) and the role has an expression like:

[Email] = USERPRINCIPALNAME

Meaning that users in this Role can only see their own row. This row is then linked (related) to the rest of your data in your other tables meaning that only related rows to this single row are visible to the person in the RLS role.

You publish the dataset. Then, in the Security for the dataset in the Service you add users to this Role. Now, when they view reports based on the dataset, they only see their own information. Now, the caveat is that you do NOT want to add those users to the workspace because that overrides RLS.

[Anonymous]

Hi Greg,

it means every user  should go to dataset and need to select secuirty  then only  user can only see his data(restricted data) by applying security at the dataset level.

Please confrim and provide more Links/inputs.

Thanks,

Raghu

[Greg_Deckler · Accepted solution]

@Anonymous You have to add the user into an RLS role at the dataset. With Dynamic RLS that is generally a role that implements a filter on a security table like [Email] = USERPRINCIPALNAME()

[Anonymous]

Hi Greg,

We have only  Job id and first name,last name only and we don’t have email . Based on the job id only we need to assign roles .if we look at below screebshot we have only job id.

Can you please confirm any DAX function available to apply roles on the Job id ?

Thanks,

Raghu

[Anonymous]

HI All,

I have issues with applying  row level security  in power bi.

When i apply security role, at dataset level and applying test as role it is working fine and able to see my own data .

but when I run the report in power bi app without applying dataset level (test as role)  as default not able to see the  my own data.        

Please confirm each time we should go to dataset level and apply test as role required to see own data ?

thanks,

Raghu

[Anonymous]

Thanks Greg.

Can you please confrim the below ?

I have added the users in to RLS role still users not able to see they own data when user run the report as default but when user goes to dataset level with apply Security  then only user able to see the they own data .  we need when user run report first time the user want to see own data with out apply dataset security level manually each and every time . please confirm on the same.

Thanks,

Raghu

[new2pbix]

@Anonymous / @Greg_Deckler 
Did you ever get this figured out? I am trying to implement RLS but my problem is that every week a new report is generated and thus a new dataset is generated. Is there a way to get my 70 user list from the security settings of one dataset to the one generated the follow week for the next instance of the report?
And if not, is there a way to update my dataset on the Service with the refreshed data of the desktop application the following week, assuming i keep the same filename, without losing the security list and having to rebuild every week?

[Greg_Deckler]

@new2pbix Right, you should keep the same file name for where your user list is coming from and just refresh it.

[new2pbix]

thanks.. yeah.. i think this is the only way to get RLS to work.