Test as role doesn't work consistantly

[Rapier]

Dear All,

We are working on a solution for one of our clients, and we would like to migrate some reports from Report Server to PBI Online.

Everything went fine until we would like to set RLS. In some cases it worked well (RLS prevails for Viewers), but there are some users who is with Viewer permission, but RLS doesn't work for them (they see all of data). 

I tried all kind of variations to solve this (use different browsers, clear cache, remove and add again the user, change then change back the role), but nothing happend.

Do you have any idea, what can I do with it? 

thank you for your help

[nandukrishnavs]

@Rapier  If you are sure users have only view permission to the report and they are able to see all the data, then you have to validate the RLS logic in your local machine. 

Refer to this 

https://docs.microsoft.com/en-us/power-bi/admin/service-admin-rls#validate-the-roles-within-power-bi...

If you have implemented Dynamic RLS using USERNAME(), try to change it into USERPRINCIPALNAME ().

Did I answer your question? Mark my post as a solution!
Appreciate with a kudos 🙂

[Rapier]

@nandukrishnavsThanks for your reply, but it doesn't solve the issue. I changed all USERNAME() to USERPRINCIPALNAME(), but nothing happened.

But I have two interesting remarks:

- I had more users, who didn't work with viewer role. But now (1-2 hours after last changing their role to viewer) they seem to work well. Except 1 person (of course he is the project owner...), he is in viewer role but can see all data without any RLS. Is there any delay in changing roles?

- More interesting thing, that I took a trial, and removed him from whole workspace (and RLS too). And when I check him with Test as role, he are able to see anything! I don't understand this... Is there any higher level permission which can overwrite this roles? (e.g. O365, PBI admin)  

[nandukrishnavs]

@Rapier 

First, try to test the role in your Power BI desktop. If it is working as expected, make sure the required users have only view access in the workspace. That should be fine.

Did I answer your question? Mark my post as a solution!
Appreciate with a kudos 🙂

[GilbertQ]

I would suggest sharing the reports via an App and not have any users who need RLS applied have an App Workspace Role.

This will ensure that the RLS will work as expected.