Limited relationships: https://learn.microsoft.com/en-us/power-bi/transform-model/desktop-relationships-understand#limited-relationships
Enforcing RLS has topology restrictions.
What does topology RLS restrictions mean?
The short answer is RLS has some limitations in DirectQuery mode.
In the note, Enforcing RLS has topology restrictions, topology is referring to the infrastructure that the model resides on. i.e. the power bi service or self-hosted servers, in the case of DirectQuery.
Limited relationships are created in two cases:
With Many to Many relationships
and DirectQuery Mode
With RLS (Row Level Security), you can't use the test as role or view as role features in DirectQuery Mode when using SSO.
More about limited relationships:
https://www.sqlbi.com/articles/strong-and-weak-relationships-in-power-bi/
More about RLS:
https://learn.microsoft.com/en-us/power-bi/enterprise/service-admin-rls#considerations-and-limitations
Related
In powerBI/SSAS tabular; what would be a valid modelling decision to have a relationship as
TableX *--- 1 TableY 1--- * TableZ
Instead of: TableX * --- * TableZ
I see this in an old model, and I can't see why a direct many to many relationship wouldn't work?
Sorry for the delayed response.
Can you please confirm what is the compatibility of this model as :
Tabular models at the 1500 and higher compatibility level deployed to Azure Analysis Services, SQL Server 2019 and later Analysis Services, and Power BI Premium support many-to-many relationships.
For lower models, earlier we had to create those bridge tables
I have the next model in SSAS cube:
(Clients connect to the fact table too)
As seen, a filter in User Access will propagate all the way to the fact…
If I have a dynamic role security with some filter on DAX in User access, will it be applied even if I don’t put/select User access table in the frontend in Power BI??
Per my test, the filter gets applied only if I use a filter from that table, if I don’t use that table the dynamic security does not get applied, why is this??
You should be using the role to filter your security table.
This filters the [_login_id] column of the security table for the user.
With this filter propagating to related tables, the user cannot see any rows hidden by the RLS filter.
There are two important exceptions to this rule though. SSAS admins can see all data regardless of any filters, and in Power BI, if you are an admin, member, or contributor in the workspace, you have access to all the data and RLS does not apply to you. For testing, use the "Test as role" function from the RLS settings in the Power BI Service.
I am wanting to know how secure Row-Level Security is.
We are currently working on creating a dashboard that would be shared with 500 users within our organisation. All of these users are managers and we would be using dynamic row-level security so that each user would only be able to view information in the dashboard related to their own team.
I have tested RLS and it worked fine, but I have had another Power Bi user tell me that RLS is not completely secure as my base data is coming from excel. My base data is in excel, but I convert it into a pbix file in Power Bi desktop before creating the role, then publishing to power bi service, where I assign users to the role and give read only access.
I am wondering once I have shared the dashboard with these users is there any way for them to get around the RLS and access the base data?
Thanks in advance,
Amy
There are a number of factors to consider for imported data.
If the user can download the report, they could remove the role and access all the data. I would recommend turning this off in the Power BI Admin protal for selected users, or an AD group.
They could connect to the dataset via Excel or another report and get the data that way without the role level filter being used. Having them as read only is one way of stopping them altering the report. I would suggest deploying the report as an app, then they can only access the surfaced report not the underlying dataset.
I'm kind of new to PBI and I'm looking if it's the right tool for my case.
I would like to use Power BI Embedded in a web application for our customer (where they're logged in) which do not have any Power BI account/licence.
The database on which the reports are based are on-premise so we're would use Analysis Service Live Connection to access them.
Each customer should have his own report.
Is it possible to use RLS in that case?
Does that mean we've to create a role for each of them?
What username should be given in the EffectiveIdentity? Is it 'free text' that is used by PBI to get the username in the DAX?
If each customer will have his own report, then why do you need RLS at all? Just make the report to show what the user is supposed to see. Or you want to have a single report (or set of reports), which is shared between the users and they should see only their data? I will assume it is the later one.
I will start with the last question - the effective identity is not a "free text". It must be a valid user name, having rights to access the data, as specified in the documentation:
The effective identity that is provided for the username property must be a Windows user with permissions on the Analysis Services server.
The you can define RLS in your Analysis Service model, by adding a "users security" table, where you specify which rows should be visible to each user. Define relationships between this users security table and other tables in the model, and then let RLS to filter the data in the security table. The relationships with the rest of the model will apply cascade filtering on the data, so only relevant rows will be visible to the user. See Implement row-level security in an Analysis Services tabular model for example.
So the answer of your second question is no, you don't need a separate role for each user, because the filtering is based on the username and for every user it filters the same thing the same way.
I have created a Dataflow in power bi service. Now my client's requirements is that they want to take the data from the dataflow as per the roles. There is a user table where roles are already defined. My question is that without the relation between tables, how I am supposed to filter the data from all the tables? Is it possible at all? Or how can I make relationship of the tables in dataflow? Or any alternate procedure to take the data from dataflow as per the roles. Help me pls. Thanks in advance.
If your data supports it, for example some sort of mapping between the user and the data they are allowed to see, you will need to use Row Level Security to restrict what the end users see in the report. You will make the relationship between your dataflow and mapping table in Power BI, not the dataflow.
If you mean restricting access to the data in the dataflow based on their role, for example the user creates a report it only loads what they are allowed to see, then this functionality is not supported.
Hope that helps