Forum Discussion
How to implement object level security which will also be applied on personalize visual
Hi POSPOS, thank you for you feedback.
Unfortunately, OLS does this with objects. I always think of it in the context of data consumption via dataset, connecting an Excel file, for example. In a single pbix file, what I would suggest in your case is:
1) Hide the column or entire salary table from all users.
2) Have a metric in DAX that calculates the salary but within it a variable that allows a certain group to see or not see the value.
.UserPermissionSalary = var us = USERPRINCIPALNAME() return LOOKUPVALUE(dim_PermissionSalary[mail],dim_PermissionSalary[mail],us,BLANK())TheSalary = var salary = SUM(Salary[Salary]) var alowed = [.UserPermissionSalary] RETURN IF(ISBLANK([.UserPermissionSalary]),BLANK(),salary)I made a sample file. I hope it helps.
If it works, please give me a KUDO and mark the solution as the answer to help other users.
Pbix File: https://drive.google.com/file/d/1Xbnce-WL2qg1O4SQZHU6xGI0tkOizyfU/view?usp=sharing
Hello POSPOS,
Since Tabular Editor is not an option, the best route is to continue using TMDL (Tabular Model Definition Language), which allows you to define:
Perspectives = control what appears in the UI (including “Personalise this visual”).
DAX Roles = control access to objects (Object Level Security - OLS).
Steps to Implement Object-Level Security with TMDL
- reate roles using DAX in your TMDL file:
{ "name": "SalesManager", "expression": "USERPRINCIPALNAME() = \"[email protected]\"" } - Define object visibility (columns, measures) per role: In TMDL, you can use the isHidden property within the table or measure definition, combined with objectLevelSecurity.Example:
{
"name": "Revenue",
"isHidden": true,
"objectLevelSecurity": {
"SalesManager": "None"
}
}This hides the Revenue measure for users not in the SalesManager role.
Update Perspectives: Ensure that the perspective used for each page excludes objects that should be hidden for certain users.
Important Notes
- OLS does not prevent data loading, it only hides objects from the model.
- Combining perspectives + OLS ensures that the user:
- Only sees allowed objects in the UI.
- Cannot access hidden objects via DAX or “Personalise this visual”.
Official References
- https://learn.microsoft.com/en-us/power-bi/transform-model/tmdl/overview
- https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-object-level
✅ If this answer solved your issue, please mark it as correct to help other community members.
Zanqueta - Thank you for your response.
I tried to implement object level security using TMDL.
1) Eg: I applied the security on the field "Salary". so anyone who is assigned to the RLS, should not be seeing Salary. with this approach all the visuals that has salary field is breaking. The expectation is that they should be seeing other field and only Salary field should be hidden.
2)Ensure that the perspective used for each page excludes objects that should be hidden for certain users. -- Can you please let me know how this can be done?
I have a page and I will be assigned two groups of users to this page. First group who should be seeing salary and second group who should not see salary. How can we dynamically control this?
Hi POSPOS, thank you for you feedback.
Unfortunately, OLS does this with objects. I always think of it in the context of data consumption via dataset, connecting an Excel file, for example. In a single pbix file, what I would suggest in your case is:
1) Hide the column or entire salary table from all users.
2) Have a metric in DAX that calculates the salary but within it a variable that allows a certain group to see or not see the value.
.UserPermissionSalary = var us = USERPRINCIPALNAME() return LOOKUPVALUE(dim_PermissionSalary[mail],dim_PermissionSalary[mail],us,BLANK())TheSalary = var salary = SUM(Salary[Salary]) var alowed = [.UserPermissionSalary] RETURN IF(ISBLANK([.UserPermissionSalary]),BLANK(),salary)I made a sample file. I hope it helps.
If it works, please give me a KUDO and mark the solution as the answer to help other users.
Pbix File: https://drive.google.com/file/d/1Xbnce-WL2qg1O4SQZHU6xGI0tkOizyfU/view?usp=sharingZanqueta - Thanks for the details steps.
Below are the RLS I have created. Now, each of the RLS has a different security check.. And many user groups are assigned to each of these roles.. Out of the list, my requirement is to hide the salary info to the users that are assigned to RLS_FM(from below screenshot).
RLS_FM has access to Page 1 and RLS_GM also has access to Page 1 of the dashboard. Here, I want users assigned to RLS_FM to have access to Salary and RLS_GM should not see salary..
Also, RLS_FM should see salary from "personalise this visual" and RLS_GM should not see it.
Can you suggest how this will work with the measure.
Also, in future we may have requirement to hide dimnesions as well, eg: Date of Birth, can this be achieved as well with measure. Please suggest.
Thank you.
