Row-Level Security in Power BI

What is Row-Level Security?

RLS restricts data access at the row level. Different users see different data based on their identity, even in the same report.

Setting Up Static RLS

Step 1: Create Roles

In Power BI Desktop, go to Modeling > Manage Roles:

Role: West Region
Table: Sales
Filter: [Region] = "West"

Role: East Region
Table: Sales
Filter: [Region] = "East"

Step 2: Test Roles

Use Modeling > View as Roles to verify filters work correctly.

Step 3: Assign Users

In Power BI Service, go to dataset settings > Security and assign users to roles.

Dynamic RLS with USERPRINCIPALNAME()

Create a security table mapping users to their data access:

SecurityTable:
| UserEmail | Region |
| user1@company.com | West |
| user2@company.com | East |
| user3@company.com | West |

DAX Filter:
[UserEmail] = USERPRINCIPALNAME()

Manager Hierarchy Pattern

VAR CurrentUser = USERPRINCIPALNAME()
VAR UserID = LOOKUPVALUE(Employees[ID], Employees[Email], CurrentUser)
RETURN
    [ManagerID] = UserID ||
    [EmployeeID] = UserID ||
    PATHCONTAINS(
        LOOKUPVALUE(Employees[ManagerPath], Employees[ID], UserID),
        [EmployeeID]
    )

Performance Tips

• Keep security tables small and indexed
• Avoid complex DAX in RLS filters
• Test with large datasets before deployment
• Use DirectQuery RLS for real-time security enforcement

Always test RLS thoroughly. A misconfigured filter could expose sensitive data or block legitimate access.