26.5 Important Rules
- RLS restricts viewers. Workspace Admins, Members and Contributors can see all data, regardless of roles. Share with end users via app or Viewer role.
- If a user belongs to multiple roles, permissions are combined (union) – they see everything any of their roles allow.
- RLS filters are applied before measures run;
ALL()in a measure cannot bypass RLS. - For Live connection reports, RLS is defined in the source semantic model (or Analysis Services), not in the thin report.
- Object-Level Security (OLS) hides entire tables or columns from certain roles; it is configured with external tools such as Tabular Editor.
- Keep security tables small and maintain them in a controlled source (e.g. a SharePoint list or database table).
Always test with real accounts
Mhanje asa: before go-live, test each role with actual test users in the Service. A mistake in an RLS rule can expose confidential data, or hide data the user should see.
Ravindra Bagale's Tip
Remember one thing: RLS does not apply to workspace Admins, Members and Contributors, and bi-directional relationships can leak or block filters in unexpected ways. Give consumers Viewer or app access, and review relationship directions whenever you add RLS. Keep this in mind!
Ravindra Bagale's Tip – मराठी
एक गोष्ट लक्षात ठेवा: workspace Admins, Members आणि Contributors ना RLS लागू होत नाही, आणि bi-directional relationships अनपेक्षित पद्धतीने filters गळू देऊ शकतात किंवा अडवू शकतात. वापरणाऱ्यांना Viewer किंवा app access द्या, आणि RLS जोडताना प्रत्येक वेळी relationship directions तपासा. लक्षात ठेवा!
Ravindra Bagale's Tip – हिंदी
एक बात याद रखो: workspace Admins, Members और Contributors पर RLS लागू नहीं होता, और bi-directional relationships अनचाहे तरीके से filters को लीक कर सकती हैं या रोक सकती हैं. देखने वालों को Viewer या app access दो, और RLS जोड़ते समय हर बार relationship directions check करो. ध्यान रखना!
Thodkyaat sangaycha tar (quick recap)
Static RLS mhanje fixed rule, dynamic RLS mhanje USERPRINCIPALNAME aani security table; View as ne test kara; aani lakshat theva, RLS Admin/Member/Contributor la lagu hot nahi. Aata pudhe jaauya performance kade.