Dynamic row-level security

[Phil_PowerBI]

I have successfully created a role in Power BI to control access to the content of my report using the DAX script below:

SWITCH(

       TRUE(),

       [SecuredAccessType] = "Full Access", 1=1,

       [SecuredAccessType] = "Standard Access", 1=1,

       [SecuredAccessType] = "Limited Access" && [SecuredOfficeGroupAccessType] = "See Data of All Office Groups", 1=1,

       [SecuredAccessType] = "Limited Access" && [SecuredOfficeGroupAccessType] <> "See Data of All Office Groups", DimOriginatingOffice[Office Group] = [SecuredOfficeGroup],

       1=1

       )

I have now been told that under some conditions, it would be great if they can turn the role on and off. I have created slicer with two values to handle this – Secured and Unsecured.I also created a Measure to capture the selected value of the slicer as shown below:

 SecuredMode = SELECTEDVALUE('Report Mode'[ReportMode])

I then simply wrapped a simple IF statement around my DAX to handle this as shown below:

IF ([SecuredMode] = "Secured",

SWITCH(

       TRUE(),

       [SecuredAccessType] = "Full Access", 1=1,

       [SecuredAccessType] = "Standard Access", 1=1,

       [SecuredAccessType] = "Limited Access" && [SecuredOfficeGroupAccessType] = "See Data of All Office Groups", 1=1,

       [SecuredAccessType] = "Limited Access" && [SecuredOfficeGroupAccessType] <> "See Data of All Office Groups", DimOriginatingOffice[Office Group] = [SecuredOfficeGroup]

             ), 1=1)

 To my surprise, it appears that my slicer selection does not get recognised as no matter how many times I change the selection, my role expression always resolve to the default value of my IF statement.

Is this a limitation in POWER BI or am I doing something wrong?

[d_gosbell]

---

@Phil_PowerBI wrote:

 To my surprise, it appears that my slicer selection does not get recognised as no matter how many times I change the selection, my role expression always resolve to the default value of my IF statement.

---

This is by design. Effectively the security role is assigned and the permissions are evaluated when the user first connects. This happens before any queries are run or any slicers are evaluated. You cannot make security an optional thing that users can switch on or off themselves, the security is always processed first so that there is no way the user can bypass it. 

The only way to do what you want would be to put the users in the role with the most permissions and then put the switch logic in your measures.