Row-level-security does not apply to viewer role with dataset build permission in Analyze in Excel

[trutz]

Hi all,

We've build a data model with dynamic row-level security using the UserPrincipalName() function. All works fine in the service when we add users with viewer permission to the app workspace.

In a second step we add the "Build" permission on the underlying dataset for some users with "Viewer" role.

Now the users can create new reports, connecting to the dataset in Power BI Desktop and the RLS permissions still apply.

But when the users use "Analyze in Excel" on the dataset, the RLS no longer works.

Is this a bug or a limitation of the "Build" permission in combination with the viewer role?

Kind regards

Trutz

[v-gizhi-msft]

Hi,

See this:

Reference:

https://docs.microsoft.com/en-us/power-bi/service-admin-rls#using-rls-with-workspaces-in-power-bi 

Hope this helps.

Best Regards,

Giotto Zhi

[trutz]

Well, the affected user just had the Viewer role, no Member, Contributor nor Admin role.

There seems to be a difference between the "Build" permission and the "App (Build)" permission. I added some feedback to the article you linked to ask for a clarification.

[sjs210]

I am having the same problem, but do not see a way to apply 'Build' permission only at the app level.  I remember seeing App(Build) for users on the dataset in the past, but maybe has it changed?

Now, when I change the App to allow build permission for a specific user, it actually adds the Build permission for them to the underlying dataset (thereby disabling RLS)... I can't seem to get it to only apply to the App.   Any help is appreciated!

[trutz]

Small update: If we publish the app workspace as app and hand users a build permission via the published app, the RLS works fine with Analyze in Excel. But, of course, getting this to work in the app workspace would be better, because I can set a more granular level, who gets a build permission instead of all published app members.