Row Level Security: Exclude users from seeing data who are not in a particular AD security group.

BarnyQuack , Seem like roles are correct. Ensure that you assign security groups to these roles in Power BI Service. Under Sematic model Security option 

Hi BarnyQuack ,

Thank you for reaching out to the Microsoft Community Forum.

You are expecting that, Users in 'Payroll Users' AD group can See all data, including Payroll. And Users NOT in 'Payroll Users' AD group can see everything except Payroll.

Please create Roles.

1. Role--> ALL

DAX Filter --> No filter or [Department] = [Department] to allow all data.
Assigned to --> Members of the 'Payroll Users' AD group.

2. Role --> Payroll Hidden

DAX Filter --> [Department] <> "Payroll"
Assigned to --> All other users.

Please follow below steps.

1. Create Roles in Power BI Desktop, Go to Modeling --> Manage Roles. Create ALL --> No filter and Payroll Hidden --> Add filter as [Department] <> "Payroll". Then Publish to Power BI Service.

2. Assign Roles in Power BI Service, Go to Dataset --> Security. Assign ALL --> Add 'Payroll Users' AD group. And Payroll Hidden --> Add other users or groups.

Note: Use "View As Roles" in Power BI Desktop to simulate each role and confirm the filtering works as expected.

I hope this information helps. Please do let us know if you have any further queries.

Regards,

Dinesh