Using different roles to filter pages within a report using only Power BI Desktop on prem

[wskallmeyer]

Hi All,

I am currently struggling with a way to enforce security based on a user's department using only Power BI Desktop on premises.  I have created a role for each department so that they can only see their own's department data using RLS.  The role itself works and fitlers appropriately.  I need a way within the pbix file (on prem) to force that role on the user who opened the PBIX file on their desktop.  Maybe I give Dept HR their own file DeptHR.pbix with that RLS in it?  Can I force them to use that role when that file is opened?  And also do not allow them to change it.

Thanks in advance,

Scott

[KHorseman]

As far as I can tell, row level security is a cloud service feature. You only use the desktop app to define the filter functionality of the roles; they are enforced online. If your company simply shares pbix files among users, row level security effectively doesn't exist.

The desktop app is meant to be a designer for use before publishing online, not a published deployment solution.

[wskallmeyer]

Are there any best practices for baking the filtering into the reports so that the end users (Desktop on prem) cannot undue the work of the developer?

Thanks in advance, Scott

[KHorseman · Accepted solution]

None that I know of if by "on-prem" you mean simply sharing pbix files around the office. Again, the desktop app is specifically meant to be an editor used prior to publication online. It isn't meant to be a static viewer of published work. If your end users are all using the editor as a viewer, they can all edit. If you're not publishing to the online service, you're not using the end-user publication half of the product.