Dynamic Row Level Security (RLS) for ALL employees

[Anonymous]

Hi,

userprincipalname() can give us the user email. We can also define roles using userprincipalname() and then assign users in the app - powerbi service for dynamic filtering.

However, what if we have 300 employees in the organization and we want to limit each person to view his results ONLY?

Of course, it is difficult to manually assign 300 employees to the roles we defined to activate dynamic RLS!!!

In addition, poeple join and leave the company. So, it is difficult to do that manually!

I basically want the dynamic RLS (based on userprincipalname( ) ) work for EVERY employee that views the dashboard. This should work for all the employees of the company. More precisely, each employee should be able to see his own results and the results of people that he manages.

I have built the role in the desktop already:

[Line Manager's Email] = userprincipalname() || [Email] = userprincipalname()

But now remains the last step! Assigning 300 employees! Is there any method that we can do the job without manually assigning people to roles?

Thanks.

[v-xicai]

Hi @Anonymous ,

Currently,  Power BI allows users to assign RLS role to security group, so you may add these users to security group and assign dynamic RLS role to this group. See more : Create, edit, or delete a security group in the Office 365 admin center .

You may set Row-Level Security (RLS) to manage roles,  please see the link Power BI Desktop Dynamic security cheat sheet, which described the detailed steps. Maybe it doesn't work, there are some tips to let it work and test it efficiently.

Best Regards,

Amy 

Community Support Team _ Amy

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[amitchandak]

@Anonymous ,

Check if these can help

https://www.sqlchick.com/entries/2015/9/20/groups-in-power-bi-how-sharing-and-security-works

https://www.youtube.com/watch?v=oxYQ2GGefrs

https://www.youtube.com/watch?v=o3nyxuPzn3E

[jdbuchanan71 · Accepted solution]

You can have your admins set up a security group in active directory that contains all employees then assign that security group to the role.  You would also share the reports with that group.  When new employees start at the company they should be added to that security group by the admins which means the reports will be shared with them and the RLS will be applied.