Hi everyone, new member here. Never asked a question in a forum before, so please forgive me for any rookie mistakes!
I have been struggling with this issue since last week, and hope some of you may be able to guide me in the right direction.
Problem: Colleagues can suddenly not open reports previously shared with them. They get the “Something went wrong - Unable to load the model” error". The only immediate way to “fix” the issue appears to be to make users members of the workspace where the dataset resides. Which means dynamic Row Level Security rules will have no effect (not good). I tested with a non-RLS dataset, and there everything works as it’s supposed to. So it seems like the problem has been isolated to something to do with RLS. As our external IT consultant are currently migrating users to a new domain, I suspect there could be a connection, even though the User Principal Name hasn’t changed?
For context:
Attached is a screenshot with a dummy of my RLS setup - which worked perfectly until a few weeks ago.
I think you have pin-pointed the problem right here. According to the current Microsoft guidance:
When a specific user can’t see any data, it could be because their UPN isn’t stored or it’s entered incorrectly. It can happen abruptly because their user account has changed as the result of a name change.
That sounds like exactly the situation you are describing.
I’d suggest contacting the consultant to see if they can move the relevant users ASAP, and then plan to give your system time to shake out all of the connections. They may even have a suggestion if you discuss the PowerBi set up with them.
Thanks a lot @Heather!
Your reply now gives me the confidence to address the issue with the consultants.
Although it will probably take weeks, so I will have to find a workaround in the meantime.
There is a suggestion made in the guidance document
If you have a limited number of roles, copy your report for each role and place each one into a different workspace. Then filter the underlying dataset in each report to satisfy the role. (This means your super-users who need access to everything will have to work through multiple reports.
Another idea (if you can trust your users not to get snoopy), would be a hidden page of slicers (each synced to every page of the report, and set to filter appropriately). If that page is hidden, but you save the report with that page open when you publish it - they will only access that page once when logging in.
Finally, and this is probably the least pleasing solution, remove all users except those who are allowed to see all data - for a maintenance update.
As I was writing a looong document to forward to the consultant (I wanted to document every step) I noticed that the issue was quite simple: The mail group which had been used to assign the dynamic RLS role to all users was no longer existing due to the domain change - IT then gave me admin access to setup my own security groups, and now everything is back to normal.
I feel so sorry for not having thought of that before asking the forum for help! The thing is, with a lot of hard work going into understanding dynamic RLS and the application of SELECTCOLUMNS in PBI Desktop, it did not cross my mind that something could have changed with the role assignment in service. But I learned so much in the process, and hope others facing similar problems may come across this post in the future.
Again, thank you so much. If it hadn’t been for your guidance, I may not have sat down to document the whole process and thereby discovering the underlying cause.
