Skip to main content
cancel
Showing results for 
Search instead for 
Did you mean: 

Data Days is here! Join us now for 60+ days of learning, challenges, and connection. Learn more

Reply
Mlemmers
Helper I
Helper I

Help organizational hierarchy RLS


Hi,

 

I need some help setting up a hierarchy in RLS in PBI. In this scenario (see data below) we have Selma owning department 1 and 2. If I give her access to department 1 and 2 then she can't see all the departments below her, which she should. Klaus, for example, owns 1.1 so he should see that and everything below that. I'm going a little bit insane: I want to check whether the user logged in is the person responsible for that department and they need to see everything belonging to the departments below that as well. 

 

This article doesn't go into how to handle those cases, as the workaround here isn't enough for my scenario https://radacad.com/dynamic-row-level-security-with-organizational-hierarchy-power-bi

A similar question popped up on the forums years ago but the video referred to isn't there anymore? https://community.fabric.microsoft.com/t5/Desktop/RLS-with-org-hierarchy/m-p/1134611#M516493


Dummy data (note that Selma owns 2 departments, owner is not unique)

DepartmentParentOwneremailPathLevel 1Level 2Level 3Level 4
1nullSelmaSelma@example.com11nullnullnull
2nullSelmaSelma@example.com22nullnullnull
3nullBillBill@example.com33nullnullnull
1.11KlausKlaus@example.com1|1.111.1nullnull
1.21BlairBlair@example.com1|1.211.2nullnull
1.1.11.1ReneRene@example.com1|1.1|3.1.111.11.1.1null
2.12KatyKaty@example.com2|2.122.1nullnull
3.13SueSue@example.com3|3.133.1nullnull
3.1.13.1WilmerWilmer@example.com3|3.1|3.1.133.13.1.1null
3.1.1.13.1.1RichardRichard@example.com3|3.1|3.1|3.1.1.1.133.13.1.13.1.1.1
1 ACCEPTED SOLUTION

yes, we have a rules table that is controlled by the business. It is mostly based on ActiveDirectory but allows for overrides. That table is then matched against USERPRINCIPALNAME in the RLS rule.

View solution in original post

5 REPLIES 5
lbendlin
Super User
Super User

Treat your access permissions as lists

 

Selma = {1,2}

 

Then in your RLS rules you can test against these lists

 

Department Level 1 in {1,2} => Selma is permitted

This is on me for not mentioning it before, but an approach like that wouldn't work if I have 60 of those cases, which I have. 

Why would that not work? We have similar implementations with hundreds of such rule sets.

But then you have hundreds of manual lines? Can you talk me through this implementation more because now I feel like I'm missing some vital information. 
You set up a rule with the DAX editor of the RLS implementation, do you use USERPRINCIPALNAME()? 
So Blair should also have access to deparment 1.1.1 because that belongs to 1.1 and Selma has access to all there. How do I set it up step by step? 
Level 1 in what exactly, do I need to give a list with a hundred items or can I use a VALUES() here and how does the USERPRINCIPALNAME come in?

yes, we have a rules table that is controlled by the business. It is mostly based on ActiveDirectory but allows for overrides. That table is then matched against USERPRINCIPALNAME in the RLS rule.

Helpful resources

Announcements
Fabric Data Days is here Carousel

Fabric Data Days 2026

Don't miss out on Data Days, June 15 through August 7. Learn Fabric, Power BI, SQL, AI and more.

May Power BI Update Carousel

Power BI Monthly Update - May 2026

Check out the May 2026 Power BI update to learn about new features.

Power BI DataViz World Championships carousel

Power BI DataViz World Championships - June 2026

A new Power BI DataViz World Championship is coming this June! Don't miss out on submitting your entry.