Choosing Between RBAC and ABAC in Power BI and SSAS Tabular

[faikar]

Hello,

I would like to ask about the best approach for managing access control in a Power BI and SSAS Tabular environment.

In our company, analytics products are built using SQL Server Analysis Services (Tabular) and presented through Power BI dashboards.

We need to restrict access based on sales regions. For example:

• Users in Region 1 can only see Region 1 data

• Users in Region 2 can only see Region 2 data

• Users in Region 3 can only see Region 3 data

We are currently considering two approaches:

• Role-Based Access Control (RBAC)

• Attribute-Based Access Control (ABAC)

Which approach is more appropriate for this scenario in terms of scalability, maintainability, and alignment with Power BI and SSAS Tabular security models?

Thank you.

[v-prasare]

Hi @faikar,

We would like to confirm if our community members answer resolves your query or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are happy to help you.

Thank you for your patience and look forward to hearing from you.
Best Regards,
Prashanth Are
MS Fabric community support

[v-prasare]

Hi @faikar,

We would like to confirm if our community members answer resolves your query or if you need further help. If you still have any questions or need more support, please feel free to let us know. We are happy to help you.

Thank you for your patience and look forward to hearing from you.
Best Regards,
Prashanth Are
MS Fabric community support

[cengizhanarslan · Accepted solution]

If you create one role per region, you’ll end up with:

• Many roles as regions/subregions grow

• Users needing multi-region access → role explosion

• Higher admin overhead every org change

Instead, use a single (or few) RLS roles and drive filtering from a User ↔ Region mapping table (attributes).

 

Best Practice:

1) A security table like:

• UserRegion
• UPN (user email)
• RegionKey

2) Relationship:

• UserRegion[RegionKey] -> DimRegion[RegionKey]

3) Role filter (dynamic): 

• UserRegion[UPN] = USERPRINCIPALNAME()

Now users automatically see only their region(s). Add/remove rows in UserRegion and security updates without creating new roles. Scales well, easy to maintain, and aligns with Tabular + Power BI best practice.