Data Masking

[Power_Guy]

Hi All,
Need help on this i have a customer table whenever the user with viewer access is rendering the report he should be able to see the table visual with masked customer _address and mobile as i mentioned in the below image 

Whenever Admin is logging or opening the report he should able to see the tabe visual with non-masked informations

Please provide Best solutions and suggestions to achive this

[Anand24 · Accepted solution]

@Power_Guy ,
One suggestion on the top of my mind apart from RLS and OLS is to create a calculated column using userprincipalname().

Masked_Customer_Address = 
IF( USERPRINCIPALNAME() IN {"abc1@xyz.com", "abc2@xyz.com, "abc3@xyz.com"},  "******", [Customer_Address])

Con: For any new users, your IN operator will need constant manual appending of Email IDs if address is to be masked.

[Anand24 · Accepted solution]

@Power_Guy ,
One suggestion on the top of my mind apart from RLS and OLS is to create a calculated column using userprincipalname().

Masked_Customer_Address = 
IF( USERPRINCIPALNAME() IN {"abc1@xyz.com", "abc2@xyz.com, "abc3@xyz.com"},  "******", [Customer_Address])

Con: For any new users, your IN operator will need constant manual appending of Email IDs if address is to be masked.

[Power_Guy]

Hi @AllisonKennedy 
Thanks for the suggestion
But i don't think we can use Object level security here , becasue if i use ols here , it will hide entire field but
in my scenario user should understand it is address and because of privacy issue it is masked
so i have created two visuals one ffor admin and one for viewer, so
based on the users access , they can see only the visual which authorized them to view

so i have implemented page level security

Welcoming suggestions 😊

[AllisonKennedy · Accepted solution]

@Power_Guy You could have a masked address field and a full address field, OLS could hide the unmasked field from non admin users. 

@anand24 has an idea too, though I would flip it around so that the masked address is viewed by default and only users specified as admin see the unmasked.

Note page level security and the idea from anand are not actually security, just workarounds. This means you must be careful how you give permissions on the underlying data model / dataset, as users will still have access to the fields / data.

[AllisonKennedy]

@Power_Guy  I would recommend that this should probably be done upstream in the data warehouse or somewhere other than Power BI, but if you're wanting to do it in Power BI, you can use RLS (Row Level Security). Have you used RLS before? There is also something called Object Level Security, but I think you still need a 3rd party app to make this work.