Enable/Disable RLS by report

Question

Hi,Here's the background:&nbsp; We've implemented a split backend/frontend model in the PBI service where data models live in one workspace and the live connection reports to those data models live in various other workspaces.&nbsp; We've also implement RLS on our sales model to control access to data at the sales person, sales manager, and general manager roles.However, we've got some reporting that a person at the lowest security role (a salesperson) needs to see data for the entire company.&nbsp; For example, we publish daily rankings of salesperson performance where each salesperson is ranked against all other salespeople.&nbsp; If RLS is enabled for this report, the salesperson will only be ranked against himself since RLS will filter out data for all other salespeople.Our solution to this problem has been to create two separate data models - one that has RLS and one that does not.&nbsp; Reports that need to be controlled by salesperson are built from the RLS model while others such as the salesperson ranking are built from the non-RLS model.This works but isn't ideal.&nbsp; We have to maintain two versions of the data model and any changes have to be implemented twice to keep both models up to date.Is there a way to create a data model that can toggle RLS on/off for a specific report?&nbsp; I tried creating something in the model using a disconnected table and slicer to capture "RLS on" or "RLS off", but I can't see any way to use SELECTEDVALUE in the context of a RLS dax filter on the user table.Any thoughts or suggestions would be most welcome.Thanks!

auaero · Answer

LOL&nbsp;Greg_Deckler&nbsp;thanks for voting.I agree, it *could* be a security risk, but I wish enterprise software would trust users a little more.&nbsp; As in, throw a great big warning box on there that says, "hey dummy, if you turn this on we aren't responsible if you share data that you shouldn't have."&nbsp; I can decide whether I want the risk or not.&nbsp;&nbsp;😁

greg_deckler · Answer

AUaero&nbsp;You'd probably have to submit this as an Idea if it is not already there. Actually, did you just do that?&nbsp;Microsoft Idea &nbsp;· Enable/Disable RLS at the Report Level for Reports With Shared Data Models (powerbi.com)
&nbsp;
I voted for it! Not sure if it is exactly possible and seems like a potential big security risk actually so not sure it would ever be implemented.

greg_deckler · Answer

AUaero&nbsp;Typically the way I have seen this handled is to create an "aggregation table" that summarizes the information in the report. This is done as a DAX calculated table and no RLS is applied to it. Then you have a single data model.

auaero · Answer

Thanks&nbsp;Greg_Deckler&nbsp;- I had this thought as well and for some things (like my ranking example) I think it could work fine.&nbsp; Still, it would be nice to just turn RLS on/off so that we retain the maximum flexibility when designing the reports.

parry2k · Answer

AUaero&nbsp;Seems like you are on the right track if you have disconnected table and with the selection, you can force the RLS rules, not sure why it wouldn't work.
&nbsp;
Can you share what DAX expression you are using for RLS?
&nbsp;
✨ Follow us on LinkedIn 
&nbsp;
Check my latest blog post The Power of Using Calculation Groups with Inactive Relationships (Part 1) (perytus.com) I would ❤&nbsp;Kudos if my solution helped. 👉 If you can spend time posting the question, you can also make efforts to give Kudos to whoever helped to solve your problem. It is a token of appreciation! 
&nbsp;
⚡ Visit us at https://perytus.com, your one-stop-shop for Power BI-related projects/training/consultancy.⚡

Forum Discussion

Enable/Disable RLS by report

8 Replies

Related content

RLS for embedded PBI reports

Dynamic RLS

RLS issue.

Service - RLS

RLS issue