Switch RLS on and off within the same semantic model

[CLede1210]

Hello,

We have the need to leverage multiple different RLS rules while using the same data. This has cuased us to create very similar datasets with the only difference being how RLS is applied on each semantic model. I do not think this is an option today but it would be greatly beneficial if we were able to apply multiple different RLS rules on the same semantic model and depending on the report we could choose to apply one of those rules or completely disregard RLS all together.

[alessiomissio]

I had a similar requirement long time ago.

Different people need to see different pages.

Since we didn't want to hide pages and playing with bookmarks, we setup an externa EXCEL file adding people and subjects.

All the measures in the Datamodel would have a SecurityCheck Measure inside, that checks if USERPRINCIPALNAME() is in the list, if not the Measure returns 0 or N/A.

SECURITY_MULTIPLIER = IF(calculate(COUNTROWS(USER_EMAIL), FILTER(USER_EMAIL, USER_EMAIL[EMAIL]=UPPER(USERPRINCIPALNAME())))>=1, 1, 0)

AMOUNT_SALES = CALCULATE(SUM(ORDERS[Amount]))*[SECURITY_MULTIPLIER]

[ajohnso2]

What is your end goal, why do you need different sets of RLS? 

There are a few options depending on your desired outcome.

In answer to your above question, you can expose different pages of reports to different users within an app

Publish an app in Power BI - Power BI | Microsoft Learn

[v-yiruan-msft]

Hi @CLede1210 ,

RLS only restricts data access for users with Viewer permissions(RLS is ON). It does not apply if your workspace role is Admin, Member, or Contributor(RLS is "OFF" ).

Based on your description, it appears you aim to display different data by applying various RLS rules on the same semantic model. We can create multiple reports base on one same semantic model. You can refer to the links below for guidance on setting up static or dynamic RLS for your reports.

Row-level security (RLS) with Power BI - Microsoft Fabric | Microsoft Learn

Dynamic Row Level Security with Power BI Made Simple 

Best Regards

[littlemojopuppy]

I'm pretty sure that what we want to do isn't possible because RLS and OLS are defined as part of a model (and not in reports based on a model).  But was hoping someone had a trick on how to accomplish the objective...

[littlemojopuppy]

Hi @v-yiruan-msft we looked at dynamic RLS for some of the reports (those visible to specific sales people and their managers).  But we have other reports with intended audiences of product line managers or things like that.  Because of the conflicting RLS rules, it's not possible to combine all the rules in the same model.  End result, like @CLede1210 said, is virutally identical models for different audiences.  And these are very large datasets, so it's obviously not practical to do this either.

@ajohnso2 we thought about different pages of reports in apps but the maintenance involved with exposing pages to the correct user(s) when people change jobs frequently is also not a practical approach.

[littlemojopuppy]

Elaborating on what @CLede1210 said...

There are enteprise models for things like sales, inventory, etc.  There will be dozens of reports based on these models. As I understand it, if RLS rules are defined within the model, then those rules will be applied to all reports using that model.  Asking if possible to apply one set of RLS rules on report A and a different set of rules on report B.

Or if there are work arounds (such as exposing apps to different sets of users???)