Row-level security using Organization hierarchy not working in app/web

[gdarshna]

I have implemented RLS for the Organization hierarchy in the desktop version using the following DAX:

[EmailID] = "USERPRINCIPALNAME()"

||[Org Level 4] = "USERPRINCIPALNAME()"

||[Org Level 3] = "USERPRINCIPALNAME()"

||[Org Level 2] = "USERPRINCIPALNAME()"

||[Org Level 1] = "USERPRINCIPALNAME()"

Using "Test as roles" i tested it and it works fine. But it doesn't work in the app/web.

For example, the Manager is able to view his subordinates in the desktop version, but the cloud version shows blank values despite adding his id to the role created.

Any help is highly appreciated!

Cheers guys!!

[Arvin_]

Hi   gdarshna

Did you solve this problem?  If you did, let me know how!  I also have the same problem.

[v-shex-msft]

HI @gdarshna,

I think you don't need add " symbol to dax formula.
If you add " character, it means you are try to find out 'Email ID' or 'Org Level' columns which has text "USERPRINCIPALNAME()".

In addition, I'd like to suggest you check on group permission, current only read permission members can enable the RLS feature.

Row-level security (RLS) with Power BI

Using RLS with app workspaces in Power BI

If you publish your Power BI Desktop report to an app workspace within the Power BI service, the roles will be applied to read-only members. You will need to indicate that members can only view Power BI content within the app workspace settings.

Limitations

Here is a list of the current limitations for row-level security on cloud models.

• If you previously had roles/rules defined within the Power BI service, you will need to recreate them within Power BI Desktop.
• You can define RLS only on the datasets created using Power BI Desktop client. If you want to enable RLS for datasets created with Excel, you will need to convert your files into PBIX files first. Learn more
• Only ETL, and DirectQuery connections are supported. Live connections to Analysis Services are handled in the on-premises model.
• Q&A and Cortana is not supported with RLS at this time. You will not see the Q&A input box for dashboards if all models have RLS configured. This is on the roadmap, but a timeline is not available.
• External sharing is not currently supported with datasets that use RLS.
• For any given model, the maximum number of Azure AD principals (i.e. individual users or security groups) that can be assigned to security roles is 1,000. To assign large numbers of users to roles, be sure to assign security groups, rather than individual users.

Regards,
Xiaoxin Sheng

[gdarshna]

Hi Xiaoxin Sheng!

Thank you for your quick response!

I tried to remove " and it's still showing blank values in the web.

Also, I'm publishing it to My workspace and not to the app workspace.

Any suggestions?

[v-shex-msft]

Hi @gdarshna,

Maybe you can try to use below formula as the RLS formula:

IF (
    [EmailID] = USERPRINCIPALNAME ()
        || [Org Level 4] = USERPRINCIPALNAME ()
        || [Org Level 3] = USERPRINCIPALNAME ()
        || [Org Level 2] = USERPRINCIPALNAME ()
        || [Org Level 1] = USERPRINCIPALNAME (),
    TRUE (),
    FALSE ()
)

Regards,

Xiaoxin Sheng

[gdarshna]

It's still the same 😞

Works in the desktop but gives blanks in the web 😞

[v-shex-msft]

Hi @gdarshna,

Please write measures to display the result of ‘USERPRINCIPALNAME’ and 'USERNAME' functions.
Then, you can create card visuals with above measures to show the function result to ensure if current user is in the specific columns.

Sample measure:

USERNAME = USERNAME()

USERPRINCIPALNAME = USERPRINCIPALNAME()

>>Also, I'm publishing it to My workspace and not to the app workspace.

BTW, RLS also not works on dataset owner.

Regards,

Xiaoxin Sheng