Forum Discussion
Dynamic RLS
Hi osaz_nero ,
You are correct that Dynamic RLS eliminates the need to hardcode or maintain user filters within DAX. However, users still need to be granted access to the appropriate role. Dynamic RLS controls data visibility after authorization but Power BI requires users to be assigned to an RLS role either directly or via an Entra ID security group.
To streamline user management it is best to assign a security group to the RLS role and manage group membership as needed. This way Dynamic RLS will automatically filter data for each user based on their email without requiring DAX updates when Directors or Assistant Directors change.
Thank you.
Hi osaz_nero ,
Dynamic RLS does not require you to manually enter each Director or Assistant Director email in the DAX expression. The USERPRINCIPALNAME() function evaluates the current user and compares it to the values in your Director and Assistant Director columns.
However, users still need to be assigned to the RLS role in the Power BI Service. Dynamic RLS determines which rows are visible, but does not automatically grant access to the semantic model or report. If Directors or Assistant Directors cannot view the report, first confirm they are added to the role under Dataset Security and have access to the app, workspace, or report.
Additionally, ensure the email values in the Director and Assistant Director columns match exactly with the USERPRINCIPALNAME() value for each user. Differences in UPN format, aliases, or blank entries may prevent rows from displaying. You can use the View As feature in Power BI Desktop or Service to verify the RLS filter is working as expected for each user.
Once role assignments and email values are correct, dynamic RLS should function properly without the need to maintain a separate list of Director or Assistant Director emails in your DAX code.
Thank you.
Hi osaz_nero ,
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions.
Thank you.
Thanks Anonymous ,
I was off work Thursday/Friday. Thanks for your feedback which is really helpful. My thought was that with the dynamic RLS, I won't need to assign users to the RLS role again. My goal was to eliminate the maunal adding of users to the RLS role or updating a group of users assigned to the RLS.
Thanks so much
Hi osaz_nero ,
You are correct that Dynamic RLS eliminates the need to hardcode or maintain user filters within DAX. However, users still need to be granted access to the appropriate role. Dynamic RLS controls data visibility after authorization but Power BI requires users to be assigned to an RLS role either directly or via an Entra ID security group.
To streamline user management it is best to assign a security group to the RLS role and manage group membership as needed. This way Dynamic RLS will automatically filter data for each user based on their email without requiring DAX updates when Directors or Assistant Directors change.
Thank you.
