Check your eligibility for this 50% exam voucher offer and join us for free live learning sessions to get prepared for Exam DP-700.
Get StartedDon't miss out! 2025 Microsoft Fabric Community Conference, March 31 - April 2, Las Vegas, Nevada. Use code MSCUST for a $150 discount. Prices go up February 11th. Register now.
Hi,
I need some help setting up a hierarchy in RLS in PBI. In this scenario (see data below) we have Selma owning department 1 and 2. If I give her access to department 1 and 2 then she can't see all the departments below her, which she should. Klaus, for example, owns 1.1 so he should see that and everything below that. I'm going a little bit insane: I want to check whether the user logged in is the person responsible for that department and they need to see everything belonging to the departments below that as well.
This article doesn't go into how to handle those cases, as the workaround here isn't enough for my scenario https://radacad.com/dynamic-row-level-security-with-organizational-hierarchy-power-bi
A similar question popped up on the forums years ago but the video referred to isn't there anymore? https://community.fabric.microsoft.com/t5/Desktop/RLS-with-org-hierarchy/m-p/1134611#M516493
Dummy data (note that Selma owns 2 departments, owner is not unique)
Department | Parent | Owner | Path | Level 1 | Level 2 | Level 3 | Level 4 | |
1 | null | Selma | Selma@example.com | 1 | 1 | null | null | null |
2 | null | Selma | Selma@example.com | 2 | 2 | null | null | null |
3 | null | Bill | Bill@example.com | 3 | 3 | null | null | null |
1.1 | 1 | Klaus | Klaus@example.com | 1|1.1 | 1 | 1.1 | null | null |
1.2 | 1 | Blair | Blair@example.com | 1|1.2 | 1 | 1.2 | null | null |
1.1.1 | 1.1 | Rene | Rene@example.com | 1|1.1|3.1.1 | 1 | 1.1 | 1.1.1 | null |
2.1 | 2 | Katy | Katy@example.com | 2|2.1 | 2 | 2.1 | null | null |
3.1 | 3 | Sue | Sue@example.com | 3|3.1 | 3 | 3.1 | null | null |
3.1.1 | 3.1 | Wilmer | Wilmer@example.com | 3|3.1|3.1.1 | 3 | 3.1 | 3.1.1 | null |
3.1.1.1 | 3.1.1 | Richard | Richard@example.com | 3|3.1|3.1|3.1.1.1.1 | 3 | 3.1 | 3.1.1 | 3.1.1.1 |
Solved! Go to Solution.
yes, we have a rules table that is controlled by the business. It is mostly based on ActiveDirectory but allows for overrides. That table is then matched against USERPRINCIPALNAME in the RLS rule.
Treat your access permissions as lists
Selma = {1,2}
Then in your RLS rules you can test against these lists
Department Level 1 in {1,2} => Selma is permitted
This is on me for not mentioning it before, but an approach like that wouldn't work if I have 60 of those cases, which I have.
Why would that not work? We have similar implementations with hundreds of such rule sets.
But then you have hundreds of manual lines? Can you talk me through this implementation more because now I feel like I'm missing some vital information.
You set up a rule with the DAX editor of the RLS implementation, do you use USERPRINCIPALNAME()?
So Blair should also have access to deparment 1.1.1 because that belongs to 1.1 and Selma has access to all there. How do I set it up step by step?
Level 1 in what exactly, do I need to give a list with a hundred items or can I use a VALUES() here and how does the USERPRINCIPALNAME come in?
yes, we have a rules table that is controlled by the business. It is mostly based on ActiveDirectory but allows for overrides. That table is then matched against USERPRINCIPALNAME in the RLS rule.
March 31 - April 2, 2025, in Las Vegas, Nevada. Use code MSCUST for a $150 discount! Prices go up Feb. 11th.
Check out the January 2025 Power BI update to learn about new features in Reporting, Modeling, and Data Connectivity.
User | Count |
---|---|
143 | |
85 | |
66 | |
51 | |
45 |
User | Count |
---|---|
216 | |
89 | |
82 | |
66 | |
57 |