Power BI RLS - Extracting User Membership Dynamically

[Anonymous]

We have a security requirement within our Client to restrict data viewed the locations they manage.  I wanted to get some thoughts/inputs about your experience/research in Power BI Security Enablement.

Typically, I usually approach RLS (Row level security) within Power BI using one of the approaches below.

1. Static Security (Define security roles with static filters applied to each security role)
2. Dynamic security ( Dynamic security via User Principal – UPN/ Mapping Table between User Principal and Locations stored within data base)

We wanted to explore if it is possible to dynamically extract user memberships (Active directory)  of the logged in user that would then drive the security restriction of locations the user can view/see.

Is it possible to extract parameters beyond UPN within Power BI.

Can I pass UPN as a parameter within Power Query (In case i want to extract data via graph API for a particular user)

[Anonymous · Accepted solution]

Hi @Anonymous 

If I understand it correctly, your purpose is to be able to either get some personal information of the login user to perform a dynamic RLS without having to create and maintain the Mapping table in the model, or to query data from the data source dynamically according to the login user. However I'm afraid this is not supported currently.

Here are the answers to the questions:

Is it possible to extract parameters beyond UPN within Power BI?

Power BI itself does not support extracting Active Directory user memberships or attributes beyond the User Principal Name (UPN) within the service. 

Can I pass UPN as a parameter within Power Query (In case i want to extract data via graph API for a particular user)?

Regarding your question about passing the UPN as a parameter within Power Query to extract data via the Graph API for a particular user, Power Query does not natively support dynamic data operations based on the user's UPN due to its static query nature. Both username() and userprincipalname() are DAX functions, which are not supported in Power Query. 

Hope this would be helpful. 

Best Regards,
Jing
If this post helps, please Accept it as Solution to help other members find it. Appreciate your Kudos!

[Anonymous]

Thanks ! Your feedback was very helpful.

[_AAndrade]

Hi,

Take a look at this blog: https://radacad.com/dynamic-row-level-security-with-profiles-and-users-in-power-bi
I think yo can find what you're looking for.
Please let me know if this solve your problem or if you have any doubt please ask me.