How does row-level security without relationships work?

[Yamabushi]

Hi,

I've been reading a lot of blog posts that recommend avoiding setting up RLS with bi-directional relationships in the model. Instead, they recommend using DAX to set up the correct filters. The DAX RLS settings in these data models work even without having any relationships between some of the tables set up. How does this work?

For example, I have a test model with 3 tables.

RLS is set up this way:

And it works correctly. How can the "Users" table filter the "Categories" table, even though there is no relationship between them? I'm not satisfied with just having it work, I want to know what's behind it 🙂

Thank you!

[Yamabushi]

I understand the basics of RLS. I want to know technically how does the filtering work without having relationships between tables in the model.

[v-chenwuz-msft]

Hi @Yamabushi ,

It about the context of this expression, (in another word, each row in the category will have a expend table depend on the filtering.) It contains the whole User table if there no relationship with the current table where the expression is.

Hope this helpful.

Best Regards

Community Support Team _ chenwu zhu

[v-chenwuz-msft]

Hi @Yamabushi ,

Ok, each row in "Categories" will be identified if match the expression result you defined.

For example. the result of your expression is "a", then each rows in the table and [categories] is "a" will be load to the table. The "a" comes from all the rows of "User" where User[user] = username() then gets the max one of them.

Best Regards

Community Support Team _ chenwu zhu

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.