Forum Discussion
Conditionally filtering rows from a table with another table
- 9 months ago
Hi jeffgreenrc ,
In your scenario, you can set up the RLS filter directly on the Inventory table. This will allow admins to view all rows, while other users will only see rows permitted by their location access. You can use an expression like the following.VAR CurrentUser = USERPRINCIPALNAME() VAR IsSystemAdmin = CALCULATE ( COUNTROWS ( UserRole ), UserRole[UserId] = CurrentUser && UserRole[Role] = "System Admin" ) RETURN IF ( IsSystemAdmin > 0, TRUE(), Inventory[Location] IN CALCULATETABLE ( VALUES ( UserLocationPermission[Location] ), UserLocationPermission[UserId] = CurrentUser, UserLocationPermission[CanViewInventory] = 1 ) )Here’s an example expression you can try, please test it, and let us know how it goes.
This logic determines whether the current user has the System Admin role. If so, they are not subject to filtering and can view all rows. If not, the filter limits Inventory rows to locations where the user has permission (CanViewInventory = 1).Please implement this as the RLS rule on the Inventory table and test it using View as Role in Power BI Desktop to ensure it works correctly for your users.
Regards,
Yugandhar.
Hi jeffgreenrc
I am assuming your role table already includes the email addresses. Try the following RLS expressions:
VAR CurrentUser =
USERPRINCIPALNAME ()
VAR CurrentRole =
CALCULATE (
MAX ( UserRole[Role] ),
KEEPFILTERS ( UserRole[Email] = USERPRINCIPALNAME () )
)
RETURN
IF (
CurrentRole = "System Admin",
TRUE (),
// admin - full access
RELATED ( UserRole[Email] ) = CurrentUser // non-admin - only related rows
)
==============================
VAR CurrentUser =
USERPRINCIPALNAME ()
VAR CurrentRole =
LOOKUPVALUE ( UserRole[Role], UserRole[Email], CurrentUser )
RETURN
IF (
CurrentRole = "System Admin",
TRUE (),
// admin - full access
RELATED ( UserRole[Email] ) = CurrentUser // non-admin - only related rows
)
Since your userid repeats, you might end up creating a many-to-many relationship from UserRole to permission tables. Ensure that it is single direction only.