Forum Discussion

POSPOS's avatar
POSPOS
Post Partisan
9 months ago
Solved

How to implement object level security which will also be applied on personalize visual

Hi All, I have a reqiuirement to implement page level security and object level security and also enable "personalise this visual" feature. I implemented page level security + personalise this featu...
Need Help
  • Zanqueta's avatar
    Zanqueta
    9 months ago

    Hi POSPOS, thank you for you feedback.

    Unfortunately, OLS does this with objects. I always think of it in the context of data consumption via dataset, connecting an Excel file, for example. In a single pbix file, what I would suggest in your case is:

    1) Hide the column or entire salary table from all users.

    2) Have a metric in DAX that calculates the salary but within it a variable that allows a certain group to see or not see the value.

     

    .UserPermissionSalary = 
var us = USERPRINCIPALNAME()
return
LOOKUPVALUE(dim_PermissionSalary[mail],dim_PermissionSalary[mail],us,BLANK())

     

    TheSalary = 
var salary = SUM(Salary[Salary])
var alowed = [.UserPermissionSalary]
RETURN
IF(ISBLANK([.UserPermissionSalary]),BLANK(),salary)

     

    I made a sample file. I hope it helps.

     

    If it works, please give me a KUDO and mark the solution as the answer to help other users.

     

     


    Pbix File: https://drive.google.com/file/d/1Xbnce-WL2qg1O4SQZHU6xGI0tkOizyfU/view?usp=sharing

POSPOS's avatar
POSPOS
Post Partisan
9 months ago

Zanqueta  - Thanks for the details steps.

Below are the RLS I have created. Now, each of the RLS has a different security check.. And many user groups are assigned to each of these roles.. Out of the list, my requirement is to hide the salary info to the users that are assigned to RLS_FM(from below screenshot).

RLS_FM has access to Page 1 and RLS_GM also has access to Page 1 of the dashboard. Here, I want users assigned to RLS_FM to have access to Salary and RLS_GM should not see salary.. 

Also, RLS_FM should see salary from "personalise this visual" and RLS_GM should not see it.

Can you suggest how this will work with the measure.

 

Also, in future we may have requirement to hide dimnesions as well, eg: Date of Birth, can this be achieved as well with measure. Please suggest.

 

 

 

Thank you.

 

Zanqueta's avatar
Zanqueta
Super User
9 months ago

Hi POSPOS,

I think we are mixing concepts here. RLS with OLS. PowerBI does not currently control access by pages. One option is to think of a metric that makes navigation based on user control. But again, this does not guarantee restriction, it is just a way to guide user navigation.
To control who should or should not see salaries, simply enter those who can see the metric in an auxiliary table, as I sent in the template file. This was the best solution I found.
If your control is too complex to go beyond restricting salaries, I suggest you follow lbendlin  suggestion and separate semantic models for different audiences.