Dynamic RLS

Hi osaz_nero ,

Your current RLS logic restricts access to rows where the logged in user's email matches either the Director or Assistant Director column. If you need to grant certain users access to all data it is advisable to maintain those users in a dedicated security table and reference their membership in the RLS expression. This approach simplifies ongoing maintenance as privileged users can be added or removed without modifying the DAX code.

While a hardcoded list of email addresses may work for a small group, it is less scalable. Additionally, DAX string comparisons are generally case insensitive, so the use of lower is not necessary unless normalization is specifically required. If privileged users should always have unrestricted access, you may also consider assigning them to a separate RLS role without row restrictions.

The most suitable method will depend on how often the privileged user list changes and your preferred security management strategy.

Thank you.