How to mask sensitive columns for a set of users?

[leopinheiro_chi]

Hi all,

My dataset contains some sensitive columns like email, ssn, etc, and I would like to replace their values with "[redacted]" depending on what user is viewing the dashboard.

To achieve that I have done these steps:

1. Create a separate table containing all users with the privilege to see that information. Let's call it "privileged_users"

2. In the original table (user_info) create a measure similar to this: 

email_masked = IF(CONTAINS(privileged_users,privileged_users[user_name], USERNAME()), user_info[email], "[redacted]")

3. Use the new column email_masked in my visualization, instead of the original column

Functionally this approach seems to work. However, it becomes very very slow as the table gets bigger. In fact, sometimes the visualization errors saying that it is running out of memory.

Is there any more efficient way to achieve this? Thanks!! 

[aj1973 · Accepted solution]

Hi @leopinheiro_chi 

You need to implement OLS

Object-level security (OLS) with Power BI - Power BI | Microsoft Learn

[Greg_Deckler · Accepted solution]

@leopinheiro_chi OLS has a tendency to break visuals for users that can't see the columns. Here is an alternative approach that doesn't have that particular issue:

Column Level Security - Microsoft Fabric Community

The advantage of this approach is that there is actual security involved (in your approach if the user modifies the report or otherwise has access to the dataset, they can circumvent the obfuscation). Also, should perform fast regardless of semantic model size.

[aj1973 · Accepted solution]

Hi @leopinheiro_chi 

You need to implement OLS

Object-level security (OLS) with Power BI - Power BI | Microsoft Learn