Filtering data by 2 columns where one column value can be either a specific value or all (*)

[miken72]

Hello

I have a list of users (user table), each of who can either:

a) view data from ALL branches of the specific organisation that the user belongs to from the Clinics_orgs_inc_total datasource/table

or

b) only view data from a specific branch of the specific organisation that the user belongs tofrom the Clinics_orgs_inc_total datasource/table (they must be restricted from viewing data from the other branches of the organisation they belong to, as well as data from other organisations).

For example, a user can have in their row in the UserGroup organisation = 'WLL' and branch = 1234, so they must by restricted to view only results from the Clinics_orgs_inc_total table for branch 1234 of organisation 'WLL'.

Another user can have organisation = 'WLL' and branch = '*', so they should be allowed to see all results from the Clinics_orgs_inc_total table for all branches of the organisation 'WLL' (and neither results from any other organisations nor their related branches).

This would be simple to do in SQL with a join on 2 columns, but I am at a loss as of how to set it up in Power BI.
I have tried adding advanced filtering on the table displaying the results from the Clinics_orgs_inc_total datasource, but that doesn't solve it. 

I thought to create concatenated columns of organisation and branch codes on both sides, but I am not sure that would not allow a user to see the results from all branches from a specific organisation. Moreover, each organisation can have 100s of branches. 

To add, the report has roles based filtering and row-level security set up in it.

Any tips or help would be much appreciated  

[miken72]

Thanks @lbendlin , I did a bit more research and then tested creating another roll to which I added the users who only have access to one branch. 
In Manage Roles I added the following filter on the resultstable (Clinics_orgs_inc_total_list) so that the specified branch for a user (who will only have access to one branch) links to the branch in the resultstable. Then, when the report was published to my test workspace I added the users who are limited to view results from one branch to this new group in the security for the dataset of the report. Test running the report for those users shows the correct results, limited to the branch they are permitted to see. It works! 

[lbendlin · Accepted solution]

You can apply RLS to different tables.  RLS rules are combinatory, more permissive rules override more restrictive rules.  The equivalent of '*' is an RLS rule that always evaluates to TRUE() (that is literally what you put into the Role rule for that table)