Forum Discussion
Dynamic RLS
Hi osaz_nero ,
You are correct that Dynamic RLS eliminates the need to hardcode or maintain user filters within DAX. However, users still need to be granted access to the appropriate role. Dynamic RLS controls data visibility after authorization but Power BI requires users to be assigned to an RLS role either directly or via an Entra ID security group.
To streamline user management it is best to assign a security group to the RLS role and manage group membership as needed. This way Dynamic RLS will automatically filter data for each user based on their email without requiring DAX updates when Directors or Assistant Directors change.
Thank you.
Hi osaz_nero ,
Your current RLS logic restricts access to rows where the logged in user's email matches either the Director or Assistant Director column. If you need to grant certain users access to all data it is advisable to maintain those users in a dedicated security table and reference their membership in the RLS expression. This approach simplifies ongoing maintenance as privileged users can be added or removed without modifying the DAX code.
While a hardcoded list of email addresses may work for a small group, it is less scalable. Additionally, DAX string comparisons are generally case insensitive, so the use of lower is not necessary unless normalization is specifically required. If privileged users should always have unrestricted access, you may also consider assigning them to a separate RLS role without row restrictions.
The most suitable method will depend on how often the privileged user list changes and your preferred security management strategy.
Thank you.