Don't miss your chance to take the Fabric Data Engineer (DP-600) exam for FREE! Find out how by attending the DP-600 session on April 23rd (pacific time), live or on-demand.
Learn moreJoin the FabCon + SQLCon recap series. Up next: Power BI, Real-Time Intelligence, IQ and AI, and Data Factory take center stage. All sessions are available on-demand after the live show. Register now
Hi,
I need some help setting up a hierarchy in RLS in PBI. In this scenario (see data below) we have Selma owning department 1 and 2. If I give her access to department 1 and 2 then she can't see all the departments below her, which she should. Klaus, for example, owns 1.1 so he should see that and everything below that. I'm going a little bit insane: I want to check whether the user logged in is the person responsible for that department and they need to see everything belonging to the departments below that as well.
This article doesn't go into how to handle those cases, as the workaround here isn't enough for my scenario https://radacad.com/dynamic-row-level-security-with-organizational-hierarchy-power-bi
A similar question popped up on the forums years ago but the video referred to isn't there anymore? https://community.fabric.microsoft.com/t5/Desktop/RLS-with-org-hierarchy/m-p/1134611#M516493
Dummy data (note that Selma owns 2 departments, owner is not unique)
| Department | Parent | Owner | Path | Level 1 | Level 2 | Level 3 | Level 4 | |
| 1 | null | Selma | Selma@example.com | 1 | 1 | null | null | null |
| 2 | null | Selma | Selma@example.com | 2 | 2 | null | null | null |
| 3 | null | Bill | Bill@example.com | 3 | 3 | null | null | null |
| 1.1 | 1 | Klaus | Klaus@example.com | 1|1.1 | 1 | 1.1 | null | null |
| 1.2 | 1 | Blair | Blair@example.com | 1|1.2 | 1 | 1.2 | null | null |
| 1.1.1 | 1.1 | Rene | Rene@example.com | 1|1.1|3.1.1 | 1 | 1.1 | 1.1.1 | null |
| 2.1 | 2 | Katy | Katy@example.com | 2|2.1 | 2 | 2.1 | null | null |
| 3.1 | 3 | Sue | Sue@example.com | 3|3.1 | 3 | 3.1 | null | null |
| 3.1.1 | 3.1 | Wilmer | Wilmer@example.com | 3|3.1|3.1.1 | 3 | 3.1 | 3.1.1 | null |
| 3.1.1.1 | 3.1.1 | Richard | Richard@example.com | 3|3.1|3.1|3.1.1.1.1 | 3 | 3.1 | 3.1.1 | 3.1.1.1 |
Solved! Go to Solution.
yes, we have a rules table that is controlled by the business. It is mostly based on ActiveDirectory but allows for overrides. That table is then matched against USERPRINCIPALNAME in the RLS rule.
Treat your access permissions as lists
Selma = {1,2}
Then in your RLS rules you can test against these lists
Department Level 1 in {1,2} => Selma is permitted
This is on me for not mentioning it before, but an approach like that wouldn't work if I have 60 of those cases, which I have.
Why would that not work? We have similar implementations with hundreds of such rule sets.
But then you have hundreds of manual lines? Can you talk me through this implementation more because now I feel like I'm missing some vital information.
You set up a rule with the DAX editor of the RLS implementation, do you use USERPRINCIPALNAME()?
So Blair should also have access to deparment 1.1.1 because that belongs to 1.1 and Selma has access to all there. How do I set it up step by step?
Level 1 in what exactly, do I need to give a list with a hundred items or can I use a VALUES() here and how does the USERPRINCIPALNAME come in?
yes, we have a rules table that is controlled by the business. It is mostly based on ActiveDirectory but allows for overrides. That table is then matched against USERPRINCIPALNAME in the RLS rule.
Check out the April 2026 Power BI update to learn about new features.
If you have recently started exploring Fabric, we'd love to hear how it's going. Your feedback can help with product improvements.
A new Power BI DataViz World Championship is coming this June! Don't miss out on submitting your entry.
| User | Count |
|---|---|
| 48 | |
| 46 | |
| 41 | |
| 20 | |
| 17 |
| User | Count |
|---|---|
| 69 | |
| 67 | |
| 32 | |
| 27 | |
| 26 |