RLS, OLS and Field level security in powerbi

[sanjanarama]

I have three tables named 

User table :

UserID	Permision Set ID
1	a
1	b
2	c
3	a
4	c

Object level security table

Permision Set ID	table names
a	table1
a	table2
a	table3
b	table2
b	table3
c	table4

field level security:

Permision Set ID	column access
a	table1.name
a	table1.address
a	table3.ID
b	table2.country
b	table3.ID
c	table4.fathername

Please let me know how to implement all three using dynamicallly

sample output when user "1" is viewing the report is :

table4.fathername

rajesh

ramsi

deepak

sudeep

laksmi

[V-yubandi-msft]

Hi @sanjanarama ,

May I ask if you have resolved this issue? If so, please mark the helpful reply and accept it as the solution. This will be helpful for other community members who have similar problems to solve it faster.

Thank you.

[V-yubandi-msft]

Hi @sanjanarama ,

We haven’t received a response yet and want to ensure the solution met your needs. If you need any further assistance, feel free to reach out we’d be happy to help. If everything is working as expected, kindly mark it as Accepted as solution.

Thank You.

[V-yubandi-msft]

Hi @sanjanarama ,

I hope you had the opportunity to review the solutions shared earlier. If you have any additional questions or need further clarification, please let us know.

Additionally, I found a community discussion that might be helpful.
Solved: object level security - Microsoft Fabric Community

If there is any post helps, then please consider Accept it as the solution  to help the other members find it more quickly.

Regards,

Yugandhar.

[V-yubandi-msft]

Hi @sanjanarama ,

Please let us know if your issue is solved. If it is, consider marking the answer that helped 'Accept as Solution', so others with similar queries can find it easily. If not, please share the details.
Thank you.

[rohit1991 · Accepted solution]

Hi @sanjanarama,

To dynamically implement Row-Level Security (RLS), Object-Level Security (OLS), and Field-Level Security (FLS) in Power BI, start by defining relationships between the User Table, Object-Level Security Table, and actual data tables based on the Permission Set ID. For RLS, create a role in Manage Roles using a DAX filter like [UserID] = USERPRINCIPALNAME(), ensuring users can only see the data assigned to their Permission Set ID. For OLS, use Tabular Editor to restrict access to entire tables by filtering the Object Level Security Table to check if a table name exists in the user's assigned permissions, dynamically controlling visibility. 

To enforce FLS, create a calculated column or dynamic measure that checks if a user has permission to view a specific column, filtering the Field Level Security Table for matching Permission Set IDs and using CONTAINS logic to restrict access dynamically. By applying these techniques, when User 1 logs in, they will only see data related to their permissions, such as the father's name column from Table 4, ensuring secure and dynamic access control in Power BI.

[grazitti_sapna]

Hi @sanjanarama,

Following is one way to dynamically enforce object‐ and field‐level security with your three tables. The basic idea is to implement dynamic row‑level security (RLS) on the basis of the logged-in user and then "join" (through relationships or DAX lookups) the user's allowed permission sets to the object-level and field‑level security tables. For instance, you can establish a connection between your User table and the security tables on "Permission Set ID." Next, create an RLS role that filters the User table based on a DAX expression like:

[UserID] = USERPRINCIPALNAME() // or an appropriate mapping to the current user

Once that’s in place, you can create measures that check whether a given field should be visible. For instance, to display the values in table4.fathername only if the current user’s permission sets include access to that column (as defined in your Field Level Security table), you could write a measure like:

Visible table4 fathername =
IF(
COUNTROWS(
FILTER(
'FieldLevelSecurity',
'FieldLevelSecurity'[Column access] = "table4.fathername" &&
'FieldLevelSecurity'[Permission Set ID] IN VALUES('User'[Permision Set ID])
)
) > 0,
[table4.fathername], // your measure or column from table4
BLANK()
)

In this example, if the logged‑in user (via the filtered User table) has a permission set that allows access to “table4.fathername” (for instance, if they belong to permission set “c”), then the measure returns the field’s value; otherwise it returns BLANK(). You can use similar patterns to control which tables (object-level) and which columns (field-level) appear in your report visuals.

🌟 I hope this solution helps you unlock your Power BI potential! If you found it helpful, click 'Mark as Solution' to guide others toward the answers they need.
💡 Love the effort? Drop the kudos! Your appreciation fuels community spirit and innovation.
🎖 As a proud SuperUser and Microsoft Partner, we’re here to empower your data journey and the Power BI Community at large.
🔗 Curious to explore more? [Discover here].
Let’s keep building smarter solutions together!

[sanjanarama]

@grazitti_sapna  how can you do this measure dynamic for all the columns/fields across all the tables? we cannot create each measure for each coulmns

[sanjanarama]

can you send a pbix file, im unable to implement the solution