topic Re: DAX for RLS? in DAX Commands and Tips

DAX for RLS?

Anonymous — Tue, 16 Nov 2021 11:26:02 GMT

Is there a way in DAX to achieve the below?

I have a model with tables:

-Revenue.

-CostCenter.

I have RLS set up for two special users, that I take their USERNAME(), and I give these two users access to a specific sets of CostCenters.

Now, I am creating a new PowerBI, and I am trying to reutilize the same cube.

But, the access is based on another table named ‘Contract’, so these same two users shall have access to a set of contracts.

Can I have a way of using 2 Power BIs, pointing to the same cube, and in one report they shall see CostCenters x,y,z and in the other Contractoz a, b, c?

Or is it more convenient to just “copy paste” the entire cube (use 2 cubes) and do the RLS on each one. (I also ask this in terms of future mainteanance).

Re: DAX for RLS?

v-angzheng-msft — Mon, 22 Nov 2021 09:17:48 GMT

Hi, Anonymous

RLS set for one shared dataset will take effect for all the related reports.

Different reports based on the same dataset have the same access control for row-level security.

Copy-pasting multiple datasets for different permissions is a workaround, it's not an elegant solution, but it works.

Best Regards,
Community Support Team _ Zeon Zheng

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly

Re: DAX for RLS?

technolog — Sun, 12 Oct 2025 12:25:22 GMT

Option A - One dataset, dynamic RLS with OR logic
If both user groups can see data from either CostCenter or Contract, build dynamic RLS using security tables.
Example setup:
Security_CostCenter with columns [UPN, CostCenterKey]
Security_Contract with columns [UPN, ContractKey]
Create one RLS role that allows access if either condition is true:

VAR u = USERPRINCIPALNAME()
VAR AllowedCC = CALCULATETABLE(VALUES(Security_CostCenter[CostCenterKey]), Security_CostCenter[UPN] = u)
VAR AllowedContract = CALCULATETABLE(VALUES(Security_Contract[ContractKey]), Security_Contract[UPN] = u)
RETURN
CONTAINS(AllowedCC, Security_CostCenter[CostCenterKey], Revenue[CostCenterKey])
||
CONTAINS(AllowedContract, Security_Contract[ContractKey], Revenue[ContractKey])

This lets both reports work from the same model, while access is decided dynamically.

Option B - Two datasets with separate RLS
If the same users must see different data in different reports, create two datasets.
Dataset A uses RLS by CostCenter.
Dataset B uses RLS by Contract.
Each report connects to its own dataset. This is cleaner to maintain when access rules differ completely.

Option C - Embedded reports with selected roles
If your reports are embedded in an app, you can specify the RLS role at runtime. For example, Report 1 runs under “CostCenterRole” and Report 2 under “ContractRole”. This method works only in embedded solutions, not in regular Power BI Service.