RLS Hierarchy - Give some Managers unrestricted access

[jimrosser]

I have set up RLS path hierarchy for my organization and it reacts well.  However I'd like for CFO & CEO users to have access to all records how can I achieve this?  My model is much bigger than this but is shortened for example.

Employee ID	Employee	AD Account	Manager ID	MN
1	Employee1	Employee1@cnn.com		CEO
2	Employee2	Employee2@cnn.com		CFO
3	Employee3	Employee3@cnn.com	1
4	Employee4	Employee4@cnn.com	3
5	Employee5	Employee5@cnn.com	3
6	Employee6	Employee6@cnn.com	2
7	Employee7	Employee7@cnn.com	6
8	Employee8	Employee8@cnn.com	5
9	Employee9	Employee9@cnn.com	2

[Syndicate_Admin]

Can you provide a view of your roles?

I have solved these issues by creating a role without any conditions. Then assign admin users in the published report

[jimrosser]

@Syndicate_Admin - I don't really have any roles established, just the hierarchy of who reports to which users.  below is my security role filter:

PATHCONTAINS([Hierarchy Path], [Current User ID]) = TRUE

I'm thiking that if I were to place in the filter equaling CFO or CEO then it would allow for all access to users in the table.

Employee ID	Employee	AD Account	Manager ID	Role
1	Employee1	Employee1@cnn.com		CEO
2	Employee2	Employee2@cnn.com		CFO
3	Employee3	Employee3@cnn.com	1
4	Employee4	Employee4@cnn.com	3
5	Employee5	Employee5@cnn.com	3
6	Employee6	Employee6@cnn.com	2
7	Employee7	Employee7@cnn.com	6
8	Employee8	Employee8@cnn.com	5
9	Employee9	Employee9@cnn.com	2

[jimrosser]

i saw some stuff about creating a column with super user indicated with a1 or 0 but am having a hard

IF(

    LOOKUPVALUE(

        data987654[Super User],

        data987654[AD Account],USERPRINCIPALNAME())=1,

    true(),

    PATHCONTAINS([Hierarchy Path], [Current User ID]) = TRUE)

time getting it to work with my hierarchy

[Anonymous]

Hello,@Syndicate_Admin,thanks for your concern about this issue.

Your answer is excellent!
And I would like to share some additional solutions below.
Hi,@jimrosser .I am glad to help you.

I think you can create different rls roles by using this measure you wrote as a filter condition
When measure = True, then it means CEO, no dax constraints are set at this time.
i.e. True, otherwise it is a normal employee, applying the corresponding RLS logic restrictions as normal.
To set up row-level security (RLS) for a role like administrator or CEO to be able to view all data, you can use a simple DAX expression to ensure that the role does not have any filter constraints
like this.

IF(measure =TRUE(),
True(),
Other judgment logic...)

I hope my suggestions give you good ideas, if you have any more questions, please clarify in a follow-up reply.

Best Regards,

Carson Jian,

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.