cancel
Showing results for 
Search instead for 
Did you mean: 
Reply
Spartachris Frequent Visitor
Frequent Visitor

Row-level Security Roles Disappeared

I have a dataset published with about 50 RLS roles, some of which are currently unused (empty). This dataset was originally published about 2 months ago and most recently updated just over a week ago. This morning about half the users disappeared from their role assignments. There are other datasets in the same app/workspace with identical RLS roles & users. No other datasets were affected. All the users who lost their role assignments on the dataset did NOT lose role assignments to any other datasets or access to the app.

 

Any idea how this could happen? Are there any logs I can check to see what might have happened? I'm a Power BI Admin, but not an Exchange Admin so I don't have access to the Audit logs. Would those Audit logs contain information about RLS role changes?

7 REPLIES 7
Spartachris Frequent Visitor
Frequent Visitor

Row-level security Role assignments randomly vanished

I have a dataset published with about 50 RLS roles, some of which are currently unused (empty). This dataset was originally published about 2 months ago and most recently updated just over a week ago. This morning about half the users disappeared from their role assignments. There are other datasets in the same app/workspace with identical RLS roles & users. No other datasets were affected. All the users who lost their role assignments on the dataset did NOT lose role assignments to any other datasets or access to the app.

 

Any idea how this could happen? Are there any logs I can check to see what might have happened? I'm a Power BI Admin, but not an Exchange Admin so I don't have access to the Audit logs. Would those Audit logs contain information about RLS role changes?

nirvana_moksh Established Member
Established Member

Re: Row-level Security Roles Disappeared

I dont think RLS is part of the logging, but I can be wrong. This is very strange instance especially if you did not change the report /data set name while making the update. In your model did you add any other sources? That might be another reason but that also would have affected ALL users. So in short if your RLS was set using Username() then this should not have happened.

Spartachris Frequent Visitor
Frequent Visitor

Re: Row-level Security Roles Disappeared

No change to the dataset or report name. Actually the last upload about a week ago was just to change the formatting in some visuals - and there was no issue until this morning. RLS is set with an extremely basic filter like [Company] = "ABB". Also I didn't lose the roles themselves, I just had users removed from them somehow. Since role assignment takes place in the online service, I assume the issue lies there somewhere

Spartachris Frequent Visitor
Frequent Visitor

Re: Row-level Security Roles Disappeared

Now in the same app, a handful of users who were added to the app's access list as far back as 5/22/18 suddenly were removed from it on 6/6/18! And 2 more users were removed from their RLS Roles (but kept in the app access list). What the heck is going on here??

nirvana_moksh Established Member
Established Member

Re: Row-level Security Roles Disappeared

What can be a potential issue is if the affected users Active Directory accounts were having certain issues as well. This is more of speculation rather than a fact, because I have multiple reports with RLS on all and no one has yet gotten back to me of it breaking on its own. Maybe check if everything with their AD has been fine and nothing has changed.

Spartachris Frequent Visitor
Frequent Visitor

Re: Row-level Security Roles Disappeared

Thanks, I've started to think the issue might be in AD, too. I don't have access to that stuff but I'll see if our admins can find some info for me. I'll reply here if I find anything

Highlighted
nirvana_moksh Established Member
Established Member

Re: Row-level Security Roles Disappeared

Yeah your O365 Tenant Admin will be able to help and since you know which users have fallen off he/she can probably write a Power Shell script to see the AD properties for that user. Maybe this link will help with that if needed:

 

https://docs.microsoft.com/en-us/powershell/module/activedirectory/get-aduser?view=winserver2012-ps