Anonymize a column user name by RLS

[Sophie__]

Hello,

how can I anonymize a user column by '***' using RLS management?

Regards,

Sophie

[Greg_Deckler · Accepted solution]

@Sophie__ Check out my blog article here: Column Level Security - Microsoft Fabric Community

[v-echaithra · Accepted solution]

Hi @Sophie__ ,

Here is a workaround you can try to mask user-specific column data, you need to use a DAX measure.

Create a security table that maps usernames to their allowed visibility.
Link SecurityTable[Username] to your Users table on username.

Apply a standard RLS filter on SecurityTable, such as:
[Username] = USERPRINCIPALNAME()

Create this measure Masked User Display:
Masked User Display =
VAR CanSee =
LOOKUPVALUE(
SecurityTable[CanSeeNames],
SecurityTable[Username],
USERPRINCIPALNAME()
)
RETURN
IF(CanSee = TRUE(), SELECTEDVALUE(Users[UserName]), "***")

Use this measure in your visuals, not the original UserName column.

Hope this helps to resolve your issue.
Best Regards,
Chaithra E.

[v-echaithra]

Hi @Sophie__ ,

Thank you @Greg_Deckler , @burakkaragoz  for your inputs.

We would like to confirm if you've successfully resolved this issue or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are more than happy to continue to help you.

Thank you for your patience and look forward to hearing from you.
Best Regards,
Chaithra E.

[Greg_Deckler · Accepted solution]

@Sophie__ Check out my blog article here: Column Level Security - Microsoft Fabric Community

[burakkaragoz]

Hi @Sophie__ ,

You can’t directly mask column values using RLS itself, but you can combine RLS with a DAX measure or calculated column to conditionally anonymize the data based on the logged-in user.

Here’s a simple approach:

1. Create a security table that maps usernames to their allowed visibility (e.g., show/hide).
2. Use a DAX expression like this in a calculated column or measure:

MaskedUser =
IF(
    RELATED(SecurityTable[CanSeeNames]) = TRUE(),
    'YourTable'[UserName],
    "***"
)

Then use MaskedUser in your visuals instead of the original UserName column.

This way, users who are not allowed to see names will only see "***", while others will see the actual values — all controlled by RLS.

Let me know if you want help setting up the security table or the RLS rules.

If my response resolved your query, kindly mark it as the Accepted Solution to assist others. Additionally, I would be grateful for a 'Kudos' if you found my response helpful.

Translation and text formatting supported by AI assistance

[Sophie__]

Hello @burakkaragoz , thank you for your reply.
But when I tested this solution, it didn't hide all the column data, only the rows.
Is this because I misapplied RLS?

Sophie