fabric-pbi-security-remediate

Name: fabric-pbi-security-remediate
Author: PatrickGallucci

16stars1forks

How to install fabric-pbi-security-remediate?

patrickgallucci/fabric-skills/fabric-pbi-security-remediate

$npx -y skills add PatrickGallucci/fabric-skills --skill fabric-pbi-security-remediate

Installs into the current project.

Summary

Diagnose and resolve Microsoft Fabric Power BI security issues including row-level security (RLS), object-level security (OLS), column-level security (CLS), workspace permissions, sensitivity labels, service principal authentication, XMLA endpoint access, DirectLake security fall

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Fabric Power BI Security remediate
2
3	Systematic diagnostic toolkit for resolving security and access control issues across the Microsoft Fabric Power BI stack. Covers workspace permissions, data-level security (RLS/OLS/CLS), sensitivity labels, service principal access, and governance policy restrictions.
4
5	## When to Use This Skill
6
7	- User reports "access denied" or "unauthorized" errors in Power BI reports or workspaces
8	- Report visuals show blank data or "field cannot be found" errors
9	- RLS filters are not applying correctly or returning unexpected data
10	- Sensitivity labels are greyed out, blocking exports, or preventing publishing
11	- Service principal cannot access workspaces or semantic models
12	- DirectLake reports fall back to DirectQuery unexpectedly due to security
13	- DLP or Purview protection policies are blocking item access
14	- Workspace role assignments are not behaving as expected
15	- XMLA endpoint connections fail with permission errors
16	- Users lose access to items after policy or label changes
17
18	## Prerequisites
19
20	- PowerShell 7+ with `MicrosoftPowerBIMgmt` module
21	- Fabric Admin or Workspace Admin role for diagnostic scripts
22	- Power BI REST API access (interactive or service principal)
23	- Optional: Tabular Editor for OLS/RLS inspection
24
25	Install required modules:
26
27	```powershell
28	Install-Module -Name MicrosoftPowerBIMgmt -Scope CurrentUser -Force
29	Install-Module -Name Az.Accounts -Scope CurrentUser -Force
30	```
31
32	## Quick Diagnostic Flowchart
33
34	```
35	User reports access issue
36	│
37	├─ Can they see the workspace? ─── NO ──► Check workspace role assignment
38	│ See: Workspace Permissions
39	│
40	├─ Can they see the item? ──────── NO ──► Check item-level sharing or
41	│ Purview/DLP policies
42	│ See: Governance Policy Restrictions
43	│
44	├─ Can they see data in visuals? ─ NO ──► Check RLS role membership
45	│ and DAX filter expressions
46	│ See: RLS remediate
47	│
48	├─ Do visuals show "field not YES ─► Check OLS/CLS configuration
49	│ found" errors? See: OLS/CLS remediate
50	│
51	├─ Can they export/download? ───── NO ──► Check sensitivity label encryption
52	│ and export settings
53	│ See: Sensitivity Labels
54	│
55	└─ XMLA or API errors? ────────────────► Check endpoint settings, service
56	principal permissions, and capacity
57	See: XMLA & API Access
58	```
59
60	## Step-by-Step Workflows
61
62	### 1. Workspace Permission Issues
63
64	Symptoms: User cannot see workspace or items within it.
65
66	1. Verify the user's workspace role:
67
68	```powershell
69	# Run the diagnostic script
70	./scripts/Get-PBISecurityDiagnostic.ps1 -WorkspaceName "Sales Analytics" -UserEmail "user@contoso.com"
71	```
72
73	2. Understand the permission hierarchy:
74
75	\| Role \| See Items \| Use Items \| OneLake Access \| RLS Enforced? \|
76	\|------\|-----------\|-----------\|----------------\|---------------\|
77	\| Admin \| ✅ \| ✅ \| ✅ \| ❌ (bypassed) \|
78	\| Member \| ✅ \| ✅ \| ✅ \| ❌ (bypassed) \|
79	\| Contributor \| ✅ \| ✅ \| ✅ \| ❌ (bypassed) \|
80	\| Viewer \| ✅ \| Read-only \| ❌ \| ✅ (enforced) \|
81
82	3. Key rule: RLS only applies to Viewers. If a user has Admin, Member, or Contributor role, RLS is bypassed entirely.
83
84	4. To enforce RLS, ensure content consumers have only Viewer workspace role and only Read permission on the semantic model.
85
86	### 2. Row-Level Security (RLS) Not Filtering
87
88	Symptoms: Users see all data instead of their filtered subset.
89
90	See [RLS remediate Guide](./references/rls-remediate.md) for the full diagnostic workflow.
91
92	Quick checks:
93
94	1. Confirm user is mapped to the correct RLS role
95	2. Verify the user has only Viewer permissions (Admin/Member/Contributor bypass RLS)
96	3. Test using "Test as role" in the Power BI service
97	4. Add a `USERNAME()` DAX measure to a card visual to verify identity
98	5. Check relationship filter directions — RLS filters only propagate through active relationships
99
100	### 3. Object-Level Security (OLS) / Column-Level Security (CLS)
101
102	Symptoms: Visuals display

People who liked this also viewed

6 picks

Type

fabric-pbi-security-remediate

16stars1forks

View on GitHub

How to install fabric-pbi-security-remediate?

patrickgallucci/fabric-skills/fabric-pbi-security-remediate

$npx -y skills add PatrickGallucci/fabric-skills --skill fabric-pbi-security-remediate

Installs into the current project.

Summary

Files · 1

View on GitHub

SKILL.md

1	# Microsoft Fabric Power BI Security remediate
2
3	Systematic diagnostic toolkit for resolving security and access control issues across the Microsoft Fabric Power BI stack. Covers workspace permissions, data-level security (RLS/OLS/CLS), sensitivity labels, service principal access, and governance policy restrictions.
4
5	## When to Use This Skill
6
7	- User reports "access denied" or "unauthorized" errors in Power BI reports or workspaces
8	- Report visuals show blank data or "field cannot be found" errors
9	- RLS filters are not applying correctly or returning unexpected data
10	- Sensitivity labels are greyed out, blocking exports, or preventing publishing
11	- Service principal cannot access workspaces or semantic models
12	- DirectLake reports fall back to DirectQuery unexpectedly due to security
13	- DLP or Purview protection policies are blocking item access
14	- Workspace role assignments are not behaving as expected
15	- XMLA endpoint connections fail with permission errors
16	- Users lose access to items after policy or label changes
17
18	## Prerequisites
19
20	- PowerShell 7+ with `MicrosoftPowerBIMgmt` module
21	- Fabric Admin or Workspace Admin role for diagnostic scripts
22	- Power BI REST API access (interactive or service principal)
23	- Optional: Tabular Editor for OLS/RLS inspection
24
25	Install required modules:
26
27	```powershell
28	Install-Module -Name MicrosoftPowerBIMgmt -Scope CurrentUser -Force
29	Install-Module -Name Az.Accounts -Scope CurrentUser -Force
30	```
31
32	## Quick Diagnostic Flowchart
33
34	```
35	User reports access issue
36	│
37	├─ Can they see the workspace? ─── NO ──► Check workspace role assignment
38	│ See: Workspace Permissions
39	│
40	├─ Can they see the item? ──────── NO ──► Check item-level sharing or
41	│ Purview/DLP policies
42	│ See: Governance Policy Restrictions
43	│
44	├─ Can they see data in visuals? ─ NO ──► Check RLS role membership
45	│ and DAX filter expressions
46	│ See: RLS remediate
47	│
48	├─ Do visuals show "field not YES ─► Check OLS/CLS configuration
49	│ found" errors? See: OLS/CLS remediate
50	│
51	├─ Can they export/download? ───── NO ──► Check sensitivity label encryption
52	│ and export settings
53	│ See: Sensitivity Labels
54	│
55	└─ XMLA or API errors? ────────────────► Check endpoint settings, service
56	principal permissions, and capacity
57	See: XMLA & API Access
58	```
59
60	## Step-by-Step Workflows
61
62	### 1. Workspace Permission Issues
63
64	Symptoms: User cannot see workspace or items within it.
65
66	1. Verify the user's workspace role:
67
68	```powershell
69	# Run the diagnostic script
70	./scripts/Get-PBISecurityDiagnostic.ps1 -WorkspaceName "Sales Analytics" -UserEmail "user@contoso.com"
71	```
72
73	2. Understand the permission hierarchy:
74
75	\| Role \| See Items \| Use Items \| OneLake Access \| RLS Enforced? \|
76	\|------\|-----------\|-----------\|----------------\|---------------\|
77	\| Admin \| ✅ \| ✅ \| ✅ \| ❌ (bypassed) \|
78	\| Member \| ✅ \| ✅ \| ✅ \| ❌ (bypassed) \|
79	\| Contributor \| ✅ \| ✅ \| ✅ \| ❌ (bypassed) \|
80	\| Viewer \| ✅ \| Read-only \| ❌ \| ✅ (enforced) \|
81
82	3. Key rule: RLS only applies to Viewers. If a user has Admin, Member, or Contributor role, RLS is bypassed entirely.
83
84	4. To enforce RLS, ensure content consumers have only Viewer workspace role and only Read permission on the semantic model.
85
86	### 2. Row-Level Security (RLS) Not Filtering
87
88	Symptoms: Users see all data instead of their filtered subset.
89
90	See [RLS remediate Guide](./references/rls-remediate.md) for the full diagnostic workflow.
91
92	Quick checks:
93
94	1. Confirm user is mapped to the correct RLS role
95	2. Verify the user has only Viewer permissions (Admin/Member/Contributor bypass RLS)
96	3. Test using "Test as role" in the Power BI service
97	4. Add a `USERNAME()` DAX measure to a card visual to verify identity
98	5. Check relationship filter directions — RLS filters only propagate through active relationships
99
100	### 3. Object-Level Security (OLS) / Column-Level Security (CLS)
101
102	Symptoms: Visuals display

People who liked this also viewed

6 picks

Type