Forum Discussion
Performance Optimization for Power BI Row Level Security Model
Hi sumanthkakarla,
We sincerely apologize for the inconvenience caused.
As the issue remains unresolved, we kindly request you to raise the matter at Issues - Microsoft Fabric Community for investigation. Alternatively, you may raise a Microsoft support ticket using the link provided below. They will be able to offer specific insights related to your account and potential resolutions.
Microsoft Fabric Support and Status | Microsoft Fabric
If you find our response helpful, we would appreciate it if you could mark it as the accepted solution and provide kudos. This will assist other community members who may be facing similar queries.
Thank you.
Hi sumanthkakarla,
Thank you for your follow-up.
Kindly follow the steps mentioned below, which may assist in resolving the issue:
-
Ensure that relationships are configured with single-directional filtering to support Row-Level Security (RLS):
-
USER_LOOKUP → client_account_bridge.Establish a one-to-many relationship with the filter flowing from USER_LOOKUP to client_account_bridge.
-
client_account_bridge → CLIENT_LOOKUP.Define a many-to-one relationship with the default filter flowing from CLIENT_LOOKUP to client_account_bridge. The RLS filter direction will be managed in Step 2.
-
CLIENT_LOOKUP → TAT Only.Create a one-to-many relationship with the filter flowing from CLIENT_LOOKUP to TAT Only.
In the Model view, double-click on each relationship to confirm the cardinality, and set the Cross-Filter Direction to "Single" to ensure predictable filter propagation and optimal performance.
-
-
To ensure that the RLS filter propagates correctly from client_account_bridge to CLIENT_LOOKUP and subsequently to TAT Only:
-
Apply the RLS filter to the client_account_bridge table. This will restrict the bridge table based on the logged-in user, allowing the filter to naturally propagate through the relationships to CLIENT_LOOKUP and TAT Only. This method eliminates the need for bidirectional filtering.
-
Navigate to the Modeling tab, click on Manage Roles, and create a new role named "Dynamic RLS".
-
Apply the RLS filter to client_account_bridge to determine whether the logged-in user has access to all data (based on a predefined condition) or only their assigned accounts.
-
Save the role and test its functionality using the View As feature with sample users (e.g., an internal user with full access and an external user with restricted access).
-
This approach ensures that the correct data is displayed while maintaining optimal performance by avoiding bidirectional filtering.
If you find this response helpful, kindly mark it as the accepted solution and provide your feedback. Your acknowledgment will assist other community members facing similar queries.
Thank you.
Thank you v-pnaroju-msft , i did the same thing like you told me to do, but when i test the Dynamic RLS with one user who has access to only 10 accounts now he is seeing all the data, may be my Dynamic RLS Dax is not workign as epxcted, but just to note the same exact Dax is working on regualr dahabord where we have many-many relation ship. Here are the relation ships and their setup
1. USER_LOOKUP to CLIENT_ACCOUNT_BRIDGE (one-to-many relationship which filters client_account_bridge table using user_lookup table,
2. CLIENT_ACCOUNT_BRIDGE--->CLIENT_LOOKUP ( many-to-one relationship which filters client_account_bridge using client_lookup)
3.Client_lookup --> Tat Only ( one -to-many relationship wihcih filters Tat only using client_lookup)
4. Finally here is the Dynamic RLS Dax query ( which is wokring in regular dashbaord)
Not sure whats going wrong here.
OVerall Data model: