Forum Discussion
Implementing RLS to account for dual roles - possible?
- 9 years ago
Wanted to follow up to let folks know I found a perfect solution to my problem, and now am able to have one report power both a manager and an individual dashboard - and the solution was to restructure my usertable completely.
Instead of having a structure like this:
I opted to flip the table and have a 1-1 relationship with each Team Member and any and all managers above them, including a line for a manager to his/herself... so the new structure is more like this:
and the only rule I have in RLS is ViewerUPN=userprincipalname() and everyone in [Viewer] column is placed into that role.
The Team Member UPN column drives a fact table that has data related to each team member, so the team member column is the many side of a many-to-one relationship which then controls access to data in the rest of the data model.
Then, my reports all have a slicer that have slicer buttons like so:
When I pin any visual to the individual level dashboard, I make sure the report is filtered on "Me" before pinning, thereby always pinning individual level data, but when saving the report, I make sure to clear the slicer and report filter, showing everyone on the team's data - what this allows for is that if any individual logs into the individual level dashboard, data shown is only for his/herself - i.e. Keith only sees Keith's data, Eloise sees only Eloise's data, John only see's John's data, BUT, when clicking on a dashboard tile to get more details from a report, when John is taken to the report, his only option in the slicer is "Me" since he has no association with anyone other than himself between the viewer and team member columns.
For Keith, when he clicks on "Me" he sees just his own data on the report, but when he clicks on "Reports to Me" he sees data for every Team Member that rolls up into him.
Using the same report then, I place a filter for 'reports to me' on the report, and then pin those visuals to the manager level dashboard, but again, I don't save the report with any filter in place. This dashboard is only shared with any manager that has someone reporting to them, but it leads back to the same report as the individual level ones. I could create custom url's for each report and append the filter into the URL to force "Reports to Me" to be selected when originating from the manager dashboard, or "Me" when originating from the individual dashboard, but I haven't gotten around to it yet...i'm just excited I can streamline report and dashboard creation for multiple management levels, control security in a very easy to manage way, and deliver a really easy intuitive UX - and all it took was restructuring how my security table was set up!
If anyone wants a demo of the functionality I created - let me know! I'll see if I can mock up a personal dashboard that gives you a sense of how you can use one report for multiple audiences and share it out to folks.
Hi anktaggrwl,
Is there any way to propogate a measure-based filter to the entire report or even to a report page that anyone knows of? At least then, both from a development standpoint and a user standpoint, they can remove and add the filter in one place, instead of every separate visual because as it stands, again, over a large number of reports, if we have to have an individual user version vs. a manager user version of each report, having to apply the 'iscurrentUPN' measure as a filter to EVERY visual on a individual level report (if not every measure) just doesn't seem like the most sustainable solution...
I agree with you. However, I don't think there is better solution in your scenario currently. So I would suggest you add it as an idea on Power BI Ideas forum to improve Power BI on this feature. :smileyhappy:
Regards
Wanted to follow up to let folks know I found a perfect solution to my problem, and now am able to have one report power both a manager and an individual dashboard - and the solution was to restructure my usertable completely.
Instead of having a structure like this:
I opted to flip the table and have a 1-1 relationship with each Team Member and any and all managers above them, including a line for a manager to his/herself... so the new structure is more like this:
and the only rule I have in RLS is ViewerUPN=userprincipalname() and everyone in [Viewer] column is placed into that role.
The Team Member UPN column drives a fact table that has data related to each team member, so the team member column is the many side of a many-to-one relationship which then controls access to data in the rest of the data model.
Then, my reports all have a slicer that have slicer buttons like so:
When I pin any visual to the individual level dashboard, I make sure the report is filtered on "Me" before pinning, thereby always pinning individual level data, but when saving the report, I make sure to clear the slicer and report filter, showing everyone on the team's data - what this allows for is that if any individual logs into the individual level dashboard, data shown is only for his/herself - i.e. Keith only sees Keith's data, Eloise sees only Eloise's data, John only see's John's data, BUT, when clicking on a dashboard tile to get more details from a report, when John is taken to the report, his only option in the slicer is "Me" since he has no association with anyone other than himself between the viewer and team member columns.
For Keith, when he clicks on "Me" he sees just his own data on the report, but when he clicks on "Reports to Me" he sees data for every Team Member that rolls up into him.
Using the same report then, I place a filter for 'reports to me' on the report, and then pin those visuals to the manager level dashboard, but again, I don't save the report with any filter in place. This dashboard is only shared with any manager that has someone reporting to them, but it leads back to the same report as the individual level ones. I could create custom url's for each report and append the filter into the URL to force "Reports to Me" to be selected when originating from the manager dashboard, or "Me" when originating from the individual dashboard, but I haven't gotten around to it yet...i'm just excited I can streamline report and dashboard creation for multiple management levels, control security in a very easy to manage way, and deliver a really easy intuitive UX - and all it took was restructuring how my security table was set up!
If anyone wants a demo of the functionality I created - let me know! I'll see if I can mock up a personal dashboard that gives you a sense of how you can use one report for multiple audiences and share it out to folks.
- clausm738 years agoAdvocate II
This is very good. And can be extended with rows labeled "Has reported to me" if we have to deal with a slowly changing dimension for Employees.
- jjz0512797 years agoFrequent Visitor
Hi, this is very cool. I have a simular plan on emplimenting multipe user access. Can I have a demo of this?
- jjz0512797 years agoFrequent Visitor
Hi, this is very cool. I have a simular plan on emplimenting multipe user access. Can I have a demo of this?
- jasperchung107 years agoRegular Visitor
Hi @anktaggrwl,
Wondering if you had a demo I could refer to! I am doing alsmot the exact same reporting for my company!
- jasperchung107 years agoRegular Visitor
Hi @anktaggrwl,
Wondering if you had a demo I could refer to! I am doing alsmot the exact same reporting for my company!
- flyingfins7 years agoNew Member
anktaggrwl I am doing alsmot the exact same reporting Will you be able to share the demo file
Thanks
- EduSurveys6 years agoAdvocate II
anktaggrwl , thanks for working through this solution. I have a similar issue but I could see this solution being a challenge if you have a fact table with multiple rows per team member that you were trying to connect to the table you proposed in your solution because you'd get a many-to-many relationship. Any ideas on how to avoid this?
I was initially putting RLS on my dimension table (DimCourse, with instructors having access to their own data and department heads having access to both their own data and data of the faculty in their department), and I have multiple rows per team member in my fact table because they are teaching multiple students (FactGrades).
- MathildaP5 years agoFrequent Visitor
Hi, I am trying to solve the same issue. Could you attach the mock-up you have created so I could take a look?
Cheers,
Mathilda