RLS Data Masking

[prajwala]

We have implemented the Row Level Security (RLS) with Active Directory Groups.we have created Management Cost AD group for users who required access to the Cost related information.

We have a requirement where, Users who are not part of Management cost AD group should not be allowed to see Cost related information(data masking) in Power BI tabular Editor.
Please help us with some suggestions on how to impliment using Tabular Editor.

Thank you...

[Anonymous]

Hi @prajwala 

Did the solution grazitti_sapna  and johnt75  offered help you solve the problem, if them helps you can consider to accept them as solutions so that more user can refer to, if you have other problems , you can provide some information so that can offer some more suggestion for you,

Best Regards!

Yolo Zhu

[grazitti_sapna · Accepted solution]

Hi @prajwala ,

To implement RLS with data masking in Power BI, ensuring that users who are not part of a specific AD group (like Management Cost AD group) see masked or hidden cost-related information, you can achieve this by creating dynamic RLS roles using Tabular Editor and DAX expressions. Here's how you can implement it step by step:

1. Create RLS Role Using Tabular Editor
   
   1. Open your Power BI model in Tabular Editor.
   2. Go to the Roles section in the left-hand pane.
   3. Create or modify a role, such as Mask_Cost_Data.
   4. Add the DAX filter condition to check if a user is part of the Management Cost AD group.
2. Use USERNAME() or USERPRINCIPALNAME()
   The key here is leveraging USERNAME() or USERPRINCIPALNAME() to dynamically evaluate the current user's membership.
   

   Dynamic Masking Logic:
   If the user is not part of the Management Cost AD group, show masked data (e.g., zero, null, or "Restricted"). Otherwise, show the actual cost data.
   
   Example DAX Expression for Cost Columns:
   You can write this as a calculated column or modify a measure in Tabular Editor:

   MaskedCost = 
   IF (
   ISFILTERED ( 'UserADGroup'[GroupName] ) && 
   CONTAINS ( 'UserADGroup', 'UserADGroup'[GroupName], "Management Cost AD" ),
   [Cost],
   "Restricted"
   )

   Example DAX Expression for Cost Columns:
   Steps:

   1. Assume you have a table or data source with user groups linked to users. This can be imported or queried dynamically.

      • Table: 'UserADGroup' with columns:

        • [UserEmail] or [UserName] (matches USERPRINCIPALNAME()).

        • [GroupName] (contains the group names such as "Management Cost AD").

   2. Join this table to your main fact table where costs are stored.
      
      

3. Mask Data for Unauthorized Users
   Now, use the above logic within a measure instead of a column for flexibility. Modify your cost measure:

   Masked_Cost_Measure =
   VAR UserInGroup = 
   LOOKUPVALUE ( 'UserADGroup'[GroupName], 'UserADGroup'[UserEmail], USERPRINCIPALNAME() )
   RETURN
   IF ( UserInGroup = "Management Cost AD", SUM ( 'FactTable'[Cost] ), BLANK () )

   Explanation:

   • LOOKUPVALUE checks if the current user's email belongs to the Management Cost AD group.

   • If the user is part of the group, the measure shows the actual cost.

   • If not, it returns BLANK() or any masked value (e.g., "Restricted" or 0).

4. Define RLS Role for User Groups
   
   1. In Tabular Editor:
      
      • Create an RLS filter on your 'UserADGroup' table:

        'UserADGroup'[UserEmail] = USERPRINCIPALNAME()

        This ensures that users only see their respective group data.
   2. Apply this role to the model.
5. Test RLS in Power BI
   
   1. After saving changes in Tabular Editor, load the model into Power BI.
   2. Use the "View as Roles" feature to simulate different users or groups:
      
      • Test with a user who belongs to "Management Cost AD" group.
      • Test with a user who does not belong to the group.
   3. Verify that unauthorized users see masked or restricted data while authorized users see actual costs.

I hope the provided solution works for you

If I have resolved your question, please consider marking my post as a solution. Thank you!
A kudos is always appreciated—it helps acknowledge the effort and keeps the community thriving.

[johnt75]

You can use object level security as well as row level security - https://learn.microsoft.com/en-us/fabric/security/service-admin-object-level-security?tabs=table