Level 6 · Who row-level security applies to

Writing the rule is half the job. The other half is putting the right people in the role, and knowing who the role can’t restrict at all.

What you are working in

This is a quiz. Role membership and testing live in Power BI Desktop and the Service; the paths are below so you can do it at work.

Who RLS filters

Row-level security applies to people who only read: workspace Viewers, readers of the app, and people a report or semantic model was shared with for viewing. It does not apply to workspace Admins, Members or Contributors. They can edit the semantic model (and so could edit or remove the rule), so Power BI shows them every row.

That is why the usual set-up keeps two groups apart: the people who build the report get a workspace role; the people whose data must be restricted get the app, or the Viewer role, and nothing more.

Adding people to a role

Roles and their rules are created in Desktop (Modeling → Manage roles) and travel with the model when you publish. People are added in the Service: open the workspace, hover the semantic model, select More options (…) → Security. The Row-Level Security page lists the roles; pick one, type people, security groups or distribution lists under Members, and Add, then Save. The number in brackets next to a role is how many members it has. You need Contributor or higher to manage this page.

A reader who belongs to no role of a model that has roles sees no data at all, and one in two roles sees the rows either role allows (roles combine with OR).

Testing before anyone complains

• In Desktop: Modeling → View as, tick one or more roles, and for dynamic rules tick Other user and type an email. The report redraws as that person would see it until you select Stop viewing.
• In the Service: on the Security page, choose More options (…) next to a role and Test as role. At the top you can switch to Now viewing as another person to check a dynamic rule with their email.

Test with at least one person from each role, one person in no role, and one person whose territory just changed.

Common mistakes

• Testing as yourself. As the author you are an Admin or Member, so you see everything.
• Restricted readers with edit rights. A Contributor sees every row, whatever the rule says.
• Assigning in Desktop. Desktop has no place for members; that happens in the Service.
• Forgetting new hires. Add a security group to the role, not individuals, so IT keeps it current.