RLS Filtering additional dimensions

[Chewdata]

Hello! 

I can use your help with a Row Level Security question. 

I have a model on which I applied RLS based on the UPN, which works fine.
RLS filters the table Team (bridge) which in turn filters Regelingen (dim) which filters Registraties (fact) and other facttables.

We also have the dimensions Behandelaar and Reviewer which both have a long list of employees. Both have a column Team which corresponts with the column team in table Team.

My question:
I would like to filter both the Behandelaar and Reviewer Dimensions based on the RLS filtered Teams, so users only see the Behandelaren and Reviewers from their own team in the slicers. I have tried to add Behandelaren[Team] IN VALUES(Team[Team]) and Reviewer[Team] IN VALUES(Team[Team]) in the UPN role. But that doesn't seem to do the trick.

What would be the correct and cleanest way to have the slicers based on Behandelaar and Reviewer show only employees from the team. There are multiple facttables in the model, so the dimensions are needed.

[ChielFaber]

The cleanest solution is to let the data model do the work rather than trying to force it with VALUES() inside the RLS role.

Your RLS already works like this:

RLS (UPN) → Team → Regelingen → Registraties (+ other facts)

To ensure Behandelaar and Reviewer are filtered the same way, simply connect them to Team as well:

• Relationship: Team[Team] (1) → Behandelaar[Team] (*)

• Relationship: Team[Team] (1) → Reviewer[Team] (*)

• Cross-filter direction: Single (from Team to the dimension is enough)

Keep your RLS as it is on the RLS/Users table (RLS[UPN] = USERPRINCIPALNAME()).

Since RLS already filters the Team table, that filter will automatically propagate through these relationships and restrict both dimensions. Your slicers for Behandelaar and Reviewer will then only show employees from the allowed teams—without needing extra DAX conditions.

So the key is: solve it in the model, not in the VALUES() expression.

RLS (Users)
|
| 1:* (RLS filters Team via UPN → Team mapping)
v
Team
├── 1:* → Regelingen → 1:* → Registraties
├── 1:* → Behandelaar
└── 1:* → Reviewer

[xifeng_L]

It looks like an AI answer, Teams cannot be connected to the Behandelaren or Reviewers tables because they will eventually control the Registries table, which will result in an error. Because there can only be one relationship path between two tables.

[xifeng_L · Accepted solution]

Hi @Chewdata 

Your approach is correct; you need to add restrictions for Behandelaren and Reviewers to the RLS role, but the expression you used is wrong.

You should first filter out the Teams permissions that the current user has, and then use those items to restrict Behandelaren and Reviewers.

In short, you need to change Behandelaren[Team] IN VALUES(Team[Team]) to:

VAR AccessTeamItems = 
    CALCULATETABLE(
        VALUES(RLS[Team]),
        RLS[UPN]=USENAME(),
        ALL()
    )
RETURN
Behandelaren[Team] IN AccessTeamItems
// Reviewers[Team] IN AccessTeamItems

Did I answer your question? If yes, pls mark my post as a solution and appreciate your Kudos !

Thank you~

[Chewdata]

Yes this totaly did the trick, thanks a lot!

[rohit1991]

Hii @Chewdata 

Add separate RLS rules on Behandelaar and Reviewer tables using [Team] IN VALUES(Team[Team]) so they inherit the same Team restriction created by the UPN filter on the Team table; this is the cleanest and supported way to make the slicers show only employees from the user’s own team.