Dynamic Object-Level Security (OLS)

Hi HowardTaylor ,

Thank you for reaching out to Microsoft Communtiy.

Like row-level security (RLS), OLS is also defined within model roles. Currently, you can't create OLS definitions natively in Power BI Desktop. To create roles on Power BI Desktop semantic models, use external tools such as Tabular Editor.

Common patterns include:

XMLA automation (Premium / PPU): Using the XMLA endpoint with TOM/TMSL to programmatically create or update roles and OLS definitions based on external entitlement data.

Tabular Editor scripting: Generating OLS metadata from a source system (DB/JSON/Git) and deploying it via Tabular Editor (desktop or CLI).

CI/CD pipelines: Integrating OLS updates into Azure DevOps or GitHub Actions pipelines, typically triggered by entitlement changes or scheduled deployments.

TMDL / model as code: Managing roles and OLS in TMDL and redeploying the model when RBAC metadata changes.

In all cases, the “dynamic” behavior comes from automated redeployment of security metadata, not dynamic evaluation at query time. This is the standard, supported approach customers use today to keep Power BI OLS in sync with source-system RBAC.

Regards,
Chaithra E.