User Access Control \ Rights \ Permissions Question

[Rnaval]

How do I control user access? I only want users to see their agency data, not another agency's data.

[stoic-harsh]

Hey @Rnaval,

First, ensure your dataset contains user emails to map each user to their respective department. If not, create a mapping table (UserEmail vs Department) and relate it to your main data.

Setting up RLS in PBI Desktop:

Go to Modeling > Manage Roles (under security) > Create a role (say, Dept Filter) and apply this DAX filter:

// DAX
// USERPRINCIPALNAME() returns the logged-in user's email
LOWER([UserEmail]) == LOWER(USERPRINCIPALNAME())

To test, go to Modeling > View As (next to Manage Roles) > select above role + Other User and enter a test email.

After Publishing, go to Semantic Model > ... > Security > Assign users to the role. Prefer AAD Security Groups over individual emails (much more scalable this way), or you can add individual users.

Scenarios:

• Users with Contributor or higher workspace permissions bypass RLS entirely.
• RLS only enforces for Viewers, or users, the report is directly shared with.
• Users not added to Security will hit an "Access Denied" error instead of seeing filtered data.

Hope it helps! Please do share if you find more efficient approaches.

Best,

Harshit

[Rnaval]

Thanks, so how do you assign which pages specific users can access?

[stoic-harsh]

Hey @Rnaval,

RLS is enforced at the model level, and hence can't be restricted to specific pages in PBI. So once RLS is applied to a table, every page using it respect the same RLS filters. One approach is to use a separate table for that page and apply RLS only to this model. But depending on your use-case, there can be more work-arounds. Please share if you have a specific problem statement.

Best,

Harshit

[Bipin-Lala]

Hi @Rnaval ,

Can you please elaborate on your question, the community would be able to answer better.

Thanks!