Row Level Security for Regional, General and User levels

[Anonymous]

Hi, 

I'm looking for advice on how to set up RLS for when there are 3 different groups in the same report. The rules are as follows : 

- Regional Directors need to be able to see everything attributed to their region

- General Managers need to be able to see their attributed sites

- Individuals Users need to be able to see their own entries 

All of the examples I have been looking at only show the example with a single group, I am unsure as to how to account for all three of these rules in the same report. 

Any help would be greatly appreciated.

[Anonymous]

Hi @Anonymous ,

Did @Greg_Deckler  reply solve your problem? If so, please mark it as the correct solution, and point out if the problem persists.

Best Regards,
Adamk Kong

[Anonymous]

Below is an example of how my change log table is set up

User Name	Location	Change
User 1	Location 1	A
User 2	Location 2	B
User 3	Location 3	C

And this is an example of how my User table would be set up

User Name	Location	Email
User 1	Location 1	User1@Email.com
User 2	Location 2	User2@Email.com
User 3	Location 3	User3@Email.com

And then as stated I'm not sure whether to control the security all with one table, or to separate it out and have multiple tables each for Regional Manager, General Manager and User. 

[Greg_Deckler]

@Anonymous Very difficult to answer this without knowing anything about your data. This might help: Dynamic Hierarchical Row Level Security - Microsoft Fabric Community

Otherwise, Sorry, having trouble following, can you post sample data as text and expected output?
Not really enough information to go on, please first check if your issue is a common issue listed here: https://community.powerbi.com/t5/Community-Blog/Before-You-Post-Read-This/ba-p/1116882

Also, please see this post regarding How to Get Your Question Answered Quickly: https://community.powerbi.com/t5/Community-Blog/How-to-Get-Your-Question-Answered-Quickly/ba-p/38490

The most important parts are:
1. Sample data as text, use the table tool in the editing bar
2. Expected output from sample data
3. Explanation in words of how to get from 1. to 2.

[Anonymous]

Hi @Greg_Deckler , 

Thanks for replying. The blog for the post you attached is broken. 

My desired output is that the security meets the following rules : 

If USERPRINCIPLE = email from RD table then show the corresponding regions data

If USERPRINCIPLE = email from GM table then show the corresponding sites

If USERPRINCIPLE doesn't = email from either of these tables then show the corresponding user data

I can bring in any data related to the managers and users, I'm just looking for the best practice in setting this up as most examples are with a single role and not multiple roles. 

I'm not sure whether I can achieve this with a single table with all of the fields or whether it is better to have separate tables for the regional, general and users. I'm also not sure of how to write out the Dax to achieve this goal. 

Thanks again

[Greg_Deckler · Accepted solution]

@Anonymous All three links work for me. This is all going to depend on your data, which is why I was asking for how your data looks. You can have 1 or more tables it just depends on what information you have in your fact table and how you are forming the relationships. I have implemented a very basic model using 3 user tables and a single fact table. You can view as another user by going to Model, View As and then selecting a role such as RD and also check the box for "Other user" and type in "rd1@company.com" for example. Then you only see Region1 data. If you select GM role and "gm1@company.com" then you only see Site1 data. Also works at a user level. But, again, this all depends on your data and your relationships. See PBIX attached below signature.