Forum Discussion
Dynamic Row level security
- 11 months ago
Hi raju8004212 ,
To clarify it isn’t possible to pass slicer values or variables into RLS. Power BI always applies RLS first (based on user identity), and only afterwards slicers/filters.That means a “toggle RLS by slicer” design isn’t supported. The only supported approaches are:
Dynamic RLS using USERPRINCIPALNAME() and a security mapping table.
Report-level toggles (disconnected slicer + measures/filters) to switch between PU/HR views within the user’s authorized data.
Separate roles/reports if different security contexts are mandatory.
So the workarounds I shared earlier will help you simulate the toggle experience, but the true RLS logic can’t be driven by slicers.
Hi v-sshirivolu
sreeteja thanks for your response , i need to select which rls data i want to see using toggle mechanism is it possible to pass variable to rls filter
Hi raju8004212 ,
Try These Steps -
Employee Table
Employee_Name | PU_ID | HR_ID
John | 3001 | 1001
Steve | 1001 | 2002
User Table
Email | UserID
[email protected] | 1001
Create Disconnected Table
User_Role =
DATATABLE(
"TYPE", STRING,
{
{"HR"},
{"PU"}
}
)
Add Slicer to Report
Add User_Role[TYPE] as a slicer for role toggle
Apply RLS on Employee Table
VAR selectedRole = SELECTEDVALUE('User_Role'[TYPE])
RETURN
SWITCH(
TRUE(),
selectedRole = "HR", Employee[HR_ID] = LOOKUPVALUE(User[UserID], User[Email], USERPRINCIPALNAME()),
selectedRole = "PU", Employee[PU_ID] = LOOKUPVALUE(User[UserID], User[Email], USERPRINCIPALNAME()),
TRUE() // fallback - show nothing or all
)
----- This RLS rule changes based on the slicer selection.
Enable "View As Roles" for Testing
Navigate to Modeling > Manage Roles.
Apply the RLS to the Employee table using the provided expression.
Select View As Roles and choose [email protected].
Now test by selecting HR or PU from the slicer.
You’ll see results change based on selected role
Please find the attached .pbix file for your reference.
Regards,
Sreeteja.
- raju80042121 year agoFrequent Visitor
Hi v-sshirivolu
We are using pu from table a and hr from table b ,it's not passing parameters to rls
For your attachment case ur using same table to filter that will work because it's directly pass from filter, thanks for your response added few details in my one of the replies like data structure model relationship screenshot.
- v-sshirivolu1 year agoCommunity Support
Hi raju8004212 ,
In your situation, the PU and HR IDs are stored in separate tables, so the slicer can't directly pass its value to RLS as it does in my example, where both IDs are in the same table. Therefore, you'll need an additional step such as creating a bridge table or using TREATAS—to link the slicer selection to both tables.In my example, both columns were in the same table, so the slicer filtered directly without any extra setup.
To achieve this in your scenario, you have two options:
Option 1 – Bridge Table
1.Create a union table (using Power Query or DAX) that includes both PU and HR IDs, plus a column for the type.
RoleIDs =
UNION(
SELECTCOLUMNS(TableA, "RoleID", TableA[PU_ID], "RoleType", "PU"),
SELECTCOLUMNS(TableB, "RoleID", TableB[HR_ID], "RoleType", "HR")
)2.Link this bridge table to TableA and TableB using their respective ID columns, adjusting relationships as needed.
3.Set your slicer based on RoleType and RoleID from the bridge table, and use TREATAS in the RLS filter to apply the slicer value to the target table:
VAR selectedRole = SELECTEDVALUE(RoleIDs[RoleType])
VAR selectedID = SELECTEDVALUE(RoleIDs[RoleID])
RETURN
SWITCH(
TRUE(),
selectedRole = "HR", TableB[HR_ID] = selectedID,
selectedRole = "PU", TableA[PU_ID] = selectedID,
FALSE
)
Option 2 – Disconnected Slicer with TREATAS
If you prefer not to change the model structure:
1. Leave the User_Role slicer disconnected.2. In your RLS rule, use TREATAS to map the slicer value to the right table:
VAR selectedRole = SELECTEDVALUE(User_Role[TYPE])
VAR currentUser = LOOKUPVALUE(User[UserID], User[Email], USERPRINCIPALNAME())RETURN
SWITCH(
TRUE(),
selectedRole = "HR",
CALCULATE(
COUNTROWS(TableB),
TREATAS({currentUser}, TableB[HR_ID])
) > 0,
selectedRole = "PU",
CALCULATE(
COUNTROWS(TableA),
TREATAS({currentUser}, TableA[PU_ID])
) > 0,
FALSE
)
This method ensures the slicer value is applied to the correct table for the RLS check.
- v-sshirivolu1 year agoCommunity Support
Hi raju8004212 ,
I hope the information provided above assists you in resolving the issue. If you have any additional questions or concerns, please do not hesitate to contact us. We are here to support you and will be happy to help with any further assistance you may need.