Forum Discussion
Row Level Security
RLS always applies for the condition where the expression is TRUE. Imagine that you have a dimension and an RLS table like the following screenshot:
As you notice, these are not paired via any relationships... You can always test for if an evaluation is TRUE or FALSE for your RLS by creating a temporary column to check the expression:
In this sample case, I'm looking to see if [email protected] is found my RLS table, if so, let's go look for him in the Dimension table as well:
Again, as long as it returns TRUE, then RLS can be applied... I checked for User1 and seems he's found.. If I change it to another user... USERABC and he's not found so his records will be false:
Now... since we know it works... replace the hardcoded UPN with USERPRINCIPALNAME to make it dynamic in your actual RLS:
I've uploaded a sample for your reference.
Hi Rajesh_Yarlagad ,
About a month ago I believe a few people began experiencing issues with their RLS no longer working when using USERELATIONSHIP. It is likely due to a change at Microsoft's side, more information can be found here:
https://learn.microsoft.com/en-us/dax/userelationship-function-dax
Fortunately, there are two methods to avoid this...
- Build out your RLS with an active relationship
- Disconnect your RLS table completely and build a TRUE statement against your 'Store' dimension. As long as it can evaluate TRUE to the expression, it will still work.
Unfortunately, we cannot provide an active relationship between store table and fact table due to some constraints. We cannot go that route actually. Could you please brief up second approach ?
RLS always applies for the condition where the expression is TRUE. Imagine that you have a dimension and an RLS table like the following screenshot:
As you notice, these are not paired via any relationships... You can always test for if an evaluation is TRUE or FALSE for your RLS by creating a temporary column to check the expression:
In this sample case, I'm looking to see if [email protected] is found my RLS table, if so, let's go look for him in the Dimension table as well:
Again, as long as it returns TRUE, then RLS can be applied... I checked for User1 and seems he's found.. If I change it to another user... USERABC and he's not found so his records will be false:
Now... since we know it works... replace the hardcoded UPN with USERPRINCIPALNAME to make it dynamic in your actual RLS:
I've uploaded a sample for your reference.