Forum Discussion

JustDavid's avatar
JustDavid
Helper IV
10 months ago
Solved

Object Level Security "Reverse" Role

Hello,   I've went through several youtube video and googling on how to specifically hide certain columns from users from creating roles.   However, after research, it seems that i have to manual...
Need Help
Show and Tell
  • v-aatheeque's avatar
    v-aatheeque
    10 months ago

    Hi JustDavid 

    If you have applied built-in restrictions on certain columns, non-HR users won’t be able to access them directly, which can sometimes cause errors in matrix visuals. To avoid this, you can either:

    • Remove the restricted columns from the matrix entirely for non-HR users.

    • Use role-based logic to conditionally display blank (e.g : Restricted) in those columns for unauthorized users.

    Reference : Object-Level Security (OLS) with Power BI - Microsoft Fabric | Microsoft Learn

    Hope this helps,
    Thank You. 


AmiraBedh's avatar
AmiraBedh
Super User
10 months ago

Hello !

Thank you for posting on MS Fabric community.

You need to create 2 AAD groups :

HR_SeeSensitive : members: Mary, Jane, John

AllEmployees: all other users

Then create 2 model roles via tabular editor / TOM :

  • HR : modelPermission: Read and leave the sensitive columns at read or default so HR sees everything

  • NonHR : modelPermission: Read andset the sensitive columns to none so they’re invisible to this role

{
  "name": "NonHR",
  "modelPermission": "read",
  "tablePermissions": [
    {
      "name": "Employee",
      "columnPermissions": [
        { "name": "Employee Name", "metadataPermission": "none" },
        { "name": "Salary",        "metadataPermission": "none" }
      ]
    }
  ]
}

then publish and map groups to roles in the service

  • map HR_SeeSensitive to HR role

  • map AllEmployees to NonHR role