Forum Discussion

pmor's avatar
pmor
Frequent Visitor
4 months ago
Solved

Dynamic Row Level Security for masking table column values

Hello Community,   I have a PBI model which has a fact table with a column SiteID which is used to joined to a dimension table for further detail of the sites. Some sites are public and some are pr...
Need Help
  • pmor's avatar
    pmor
    4 months ago

    Thanks v-sshirivolu for that clarification. I can move on now. Cheers.

v-sshirivolu's avatar
v-sshirivolu
Community Support
4 months ago

Hi pmor ,

To implement dynamic column masking in Power BI / Fabric, create masked columns in DimSite like SiteID_Display = IF([SiteType]=External, PRV, FORMAT([SiteID], 0)) and SiteName_Display = IF([SiteType]=External, MASKED, [SiteName]). Then set up three roles: ExternalUsers ([SiteType] = External) to see only masked external rows, InternalUsers ([SiteType] <> External) to see internal rows with real values, and SuperAdmin to see all rows and original columns. Ensure the relationship flows DimSite - FactVisits and use masked columns in visuals so external users are protected, internal users see actual data, and admins have full access, all without blanks or confusion.

Please find the attached .pbix file 

Thank you.

pmor's avatar
pmor
Frequent Visitor
4 months ago

Thanks v-sshirivolu. It is another way to display duplicate columns but with Masked values. However, I need the external user to see all the sites' data, but to mask only the PRIV. So what they would see are SiteID_Display SiteName_Display column view with no filtering, i.e. They would see Alpha, Delta, but the rest would be PRIV and MASKED. And internals would see SiteID and SiteName, again with no fitering but with all names and IDs diplayed.

I may be able to use the Column formula method, but it would still need OLS to hide for roles and that would still mean that admin users see all columns.

  • v-sshirivolu's avatar
    v-sshirivolu
    Community Support
    4 months ago

    Hi pmor ,
    The DAX based masking approach works only at the visual layer and does not provide data security since the underlying values still exist in the semantic model, and for your scenario of keeping all rows visible while dynamically masking values per user within a single model, this is not a supported capability in Power BI, where the supported security options are Row-Level Security (RLS) for filtering data and Object-Level Security (OLS) for restricting access to tables or columns depending on the requirement.

    • pmor's avatar
      pmor
      Frequent Visitor
      4 months ago

      Thanks v-sshirivolu for that clarification. I can move on now. Cheers.

      • v-sshirivolu's avatar
        v-sshirivolu
        Community Support
        4 months ago

        Hi pmor ,
        Thank you for confirmation, I'm happy that you resolved the isuee
        Please feel free to contact us if you have any further questions.