Forum Discussion
Dynamic RLS
Hi osaz_nero ,
You are correct that Dynamic RLS eliminates the need to hardcode or maintain user filters within DAX. However, users still need to be granted access to the appropriate role. Dynamic RLS controls data visibility after authorization but Power BI requires users to be assigned to an RLS role either directly or via an Entra ID security group.
To streamline user management it is best to assign a security group to the RLS role and manage group membership as needed. This way Dynamic RLS will automatically filter data for each user based on their email without requiring DAX updates when Directors or Assistant Directors change.
Thank you.
Memorable MemberHi osaz_nero,
Hope you're doing well!
Regarding your screenshoot, I can say your logic is OK. Which means Directors and Assistant Directors will only see rows where their email matches either column. That part works as expected.
For the special access, you just need to extend your RETURN block with an OR condition that checks against a hardcoded list of those privileged emails:
VAR CurrentUserEmail = LOWER(USERPRINCIPALNAME())
RETURN
LOWER('Combined_Person_Post'[Director]) = CurrentUserEmail
|| LOWER('Combined_Person_Post'[Assistant Director]) = CurrentUserEmail
|| CurrentUserEmail IN {
}
In order to have a solid RLS :
- Make sure the emails in the IN {} list are lowercase, since you're already normalising USERPRINCIPALNAME() with LOWER(), a case mismatch will silently break access.
- If the privileged users are also Directors or Assistant Directors in the data, the rule already covers them, but adding them to the whitelist explicitly doesn't hurt.
- After saving, test in Power BI Service for both a standard Director and one of the whitelisted users to confirm each sees the right scope.
Assisted by AI for clarty of word!
Hope this helps! Don't forget to accept as solution and like it in order to keep helping others.
Best regards,
Oussama (Data Consultant - Expert Fabric & Power BI)
Thanks but the issue is that the director and assistant director are not able to see the rreport on the dashboard. As I wanted this to be dynamic, I wonder if I have to assign emails to the role created?
