Forum Discussion
RLS Filtering additional dimensions
Hi Chewdata
Your approach is correct; you need to add restrictions for Behandelaren and Reviewers to the RLS role, but the expression you used is wrong.
You should first filter out the Teams permissions that the current user has, and then use those items to restrict Behandelaren and Reviewers.
In short, you need to change Behandelaren[Team] IN VALUES(Team[Team]) to:
VAR AccessTeamItems = CALCULATETABLE( VALUES(RLS[Team]), RLS[UPN]=USENAME(), ALL() ) RETURN Behandelaren[Team] IN AccessTeamItems // Reviewers[Team] IN AccessTeamItemsDid I answer your question? If yes, pls mark my post as a solution and appreciate your Kudos !
Thank you~
The cleanest solution is to let the data model do the work rather than trying to force it with VALUES() inside the RLS role.
Your RLS already works like this:
RLS (UPN) → Team → Regelingen → Registraties (+ other facts)
To ensure Behandelaar and Reviewer are filtered the same way, simply connect them to Team as well:
Relationship: Team[Team] (1) → Behandelaar[Team] (*)
Relationship: Team[Team] (1) → Reviewer[Team] (*)
Cross-filter direction: Single (from Team to the dimension is enough)
Keep your RLS as it is on the RLS/Users table (RLS[UPN] = USERPRINCIPALNAME()).
Since RLS already filters the Team table, that filter will automatically propagate through these relationships and restrict both dimensions. Your slicers for Behandelaar and Reviewer will then only show employees from the allowed teams—without needing extra DAX conditions.
So the key is: solve it in the model, not in the VALUES() expression.
RLS (Users)
|
| 1:* (RLS filters Team via UPN → Team mapping)
v
Team
├── 1:* → Regelingen → 1:* → Registraties
├── 1:* → Behandelaar
└── 1:* → Reviewer
It looks like an AI answer, Teams cannot be connected to the Behandelaren or Reviewers tables because they will eventually control the Registries table, which will result in an error. Because there can only be one relationship path between two tables.