Row Level Security & Roles

[kge8888]

Hello.  I am trying to set up RLS for a dashboard and need some help with roles.  We have managers who need to see the data for their organizations.  Sometimes there is just one org they have under them, sometimes there are many.  I am having trouble with the many piece.  Example - manager is responsible for Sampletown location.  The org names for this are 1234 Sampletown Div, 1235 Sampletown Plt and 1236 Sampletown HQ.  I don't know how to set up the table filter DAX expression box so that under the Sampletown role would be any Org that contains Sampletown.  This would be ideal, or (this would take more time) but I could also enter in the org names for Sampletown but I don't know how to code those accordingly.  Any help or advise/tips would be appreciated.  Thank you in advance.  

[Which org is the employee exiting?] = "Value"  <<< how do I write the code so that it allows user to access any business that contains Sampletown or alternately how do I code the above 3 orgs so they can access all of those?  Not sure where to place " " and commas ; , etc.  

[GregMarbais]

Hey @kge8888, you can use IN instead of =

'Table'[Which org is the employee exiting?] IN {"1234 Sampletown Div", "1235 Sampletown Plt", "1236 Sampletown HQ"}

Note - I'm assuming the question is the name of the field in the table where you'd find those values.

You may find it easier to add a dimension table that ties the manager (their email) to the location and link that to your model (if you don't already have that) then you could use something like:

'manager_to_location_table'[manager.email] = userprincipalname()

I've found filtering based on the user principal name is better when who is allowed to see what changes from time to time. So I'll use this setup for my managers who lead specific sales teams and the RLS will filter based on their user principal name and the data refresh keeps which teams they're responsible for up to date rather than hard coding the teams (or in your example the locations) that they can see because updating RLS filters can only be done in the desktop file.

So if you have any tables that link the manager to the locations they are able to see in your tables, then filtering the user is likely better and you can create just 1 rule for managers and 1 rule for users and it's lot easier to manage long term (and that's coming from someone who did it the hard way once before where each person had their own entry in the RLS rules).

[kge8888]

This also works but takes more time to enter in the full name string of each org rather than just specifying "Sampletown".  I will need to read further into your filter by principal name suggestion, thank you.

[Keith-Sayer]

Hey there. Ignore the [Location] = "Value" example. Erase it and put this in and it should work (adjust table names to match your data).

CONTAINSSTRING(Table1[Location],"Sampletown")

[kge8888]

Ok looks like I got this to work for one location of Sampletown.  Now how would I code it for a new role that could view multiple locations, so the person could view Sampletown and Anytown and Yourcity.