Forum Discussion
How to implement object level security which will also be applied on personalize visual
Hi All,
I have a reqiuirement to implement page level security and object level security and also enable "personalise this visual" feature. I implemented page level security + personalise this feature using perspectives in TMDL, that is , if a user logs in , they see the page they have access to and when they click on "personalise this visual", they will see only the table relevant to that page. This works fine.
Now my requirement is to implement obj level security, eg we need to hide an object based on user login, and the same object should also be hidden from the table when user clicks on "personlise this visual".
Note: I cannot use Tabular Editor.
Can someone suggest how this can be achieved?
Thank you.
Hi POSPOS, thank you for you feedback.
Unfortunately, OLS does this with objects. I always think of it in the context of data consumption via dataset, connecting an Excel file, for example. In a single pbix file, what I would suggest in your case is:
1) Hide the column or entire salary table from all users.
2) Have a metric in DAX that calculates the salary but within it a variable that allows a certain group to see or not see the value.
.UserPermissionSalary = var us = USERPRINCIPALNAME() return LOOKUPVALUE(dim_PermissionSalary[mail],dim_PermissionSalary[mail],us,BLANK())TheSalary = var salary = SUM(Salary[Salary]) var alowed = [.UserPermissionSalary] RETURN IF(ISBLANK([.UserPermissionSalary]),BLANK(),salary)I made a sample file. I hope it helps.
If it works, please give me a KUDO and mark the solution as the answer to help other users.
Pbix File: https://drive.google.com/file/d/1Xbnce-WL2qg1O4SQZHU6xGI0tkOizyfU/view?usp=sharing
7 Replies
Page Level Security does not exist.
The better alternative to OLS is to use separate semantic models for different audiences.
Hello POSPOS,
Since Tabular Editor is not an option, the best route is to continue using TMDL (Tabular Model Definition Language), which allows you to define:
Perspectives = control what appears in the UI (including “Personalise this visual”).
DAX Roles = control access to objects (Object Level Security - OLS).Steps to Implement Object-Level Security with TMDL
- reate roles using DAX in your TMDL file:
{ "name": "SalesManager", "expression": "USERPRINCIPALNAME() = \"[email protected]\"" } - Define object visibility (columns, measures) per role: In TMDL, you can use the isHidden property within the table or measure definition, combined with objectLevelSecurity.Example:
{ "name": "Revenue", "isHidden": true, "objectLevelSecurity": { "SalesManager": "None" } }This hides the Revenue measure for users not in the SalesManager role.
Update Perspectives: Ensure that the perspective used for each page excludes objects that should be hidden for certain users.Important Notes
- OLS does not prevent data loading, it only hides objects from the model.
- Combining perspectives + OLS ensures that the user:
- Only sees allowed objects in the UI.
- Cannot access hidden objects via DAX or “Personalise this visual”.
Official References
- https://learn.microsoft.com/en-us/power-bi/transform-model/tmdl/overview
- https://learn.microsoft.com/en-us/power-bi/enterprise/service-security-object-level
✅ If this answer solved your issue, please mark it as correct to help other community members.
Zanqueta - Thank you for your response.
I tried to implement object level security using TMDL.
1) Eg: I applied the security on the field "Salary". so anyone who is assigned to the RLS, should not be seeing Salary. with this approach all the visuals that has salary field is breaking. The expectation is that they should be seeing other field and only Salary field should be hidden.
2)Ensure that the perspective used for each page excludes objects that should be hidden for certain users. -- Can you please let me know how this can be done?
I have a page and I will be assigned two groups of users to this page. First group who should be seeing salary and second group who should not see salary. How can we dynamically control this?
Hi POSPOS, thank you for you feedback.
Unfortunately, OLS does this with objects. I always think of it in the context of data consumption via dataset, connecting an Excel file, for example. In a single pbix file, what I would suggest in your case is:
1) Hide the column or entire salary table from all users.
2) Have a metric in DAX that calculates the salary but within it a variable that allows a certain group to see or not see the value.
.UserPermissionSalary = var us = USERPRINCIPALNAME() return LOOKUPVALUE(dim_PermissionSalary[mail],dim_PermissionSalary[mail],us,BLANK())TheSalary = var salary = SUM(Salary[Salary]) var alowed = [.UserPermissionSalary] RETURN IF(ISBLANK([.UserPermissionSalary]),BLANK(),salary)I made a sample file. I hope it helps.
If it works, please give me a KUDO and mark the solution as the answer to help other users.
Pbix File: https://drive.google.com/file/d/1Xbnce-WL2qg1O4SQZHU6xGI0tkOizyfU/view?usp=sharing
Hi POSPOS ,
I would also take a moment to thank Zanqueta , for actively participating in the community forum and for the solutions you’ve been sharing in the community forum. Your contributions make a real difference.
I wanted to check if you had the opportunity to review the information provided. Please feel free to contact us if you have any further questions
