Forum Discussion

powerbiexpert22's avatar
powerbiexpert22
Impactful Individual
1 year ago

dynamic rls

i have below orders data . i want to create security table which should store salesperson details along with address to apply dynamic RLS in such a way so that each salesperson should see respective orders based on salespersonid and the team lead of sales person should see all orders, please guide me on what should be coulmns of security table and how to apply RLS 

 

order_idproduct_idsalespersonidsales
1p1s120
2p2s230
3p1s110
4p3s315

 

15 Replies

    • powerbiexpert22's avatar
      powerbiexpert22
      Impactful Individual

      Hi KNP ,

      i have used the similar set up as mentioned in the article you shared however it is not working

  • Hi powerbiexpert22,

    If you want to apply dynamic RLS you need Security Table and Order Table.

    1. Secturity table at leat should have UserEmail | SalespersonID  | TeamLeadID | Address columns

    2. Make sure 

    • UserEmail: the login email used in Power BI service.
    • SalespersonID: the individual’s own salesperson ID.
    • TeamLeadID: their team lead’s ID (can be their own ID if they are a lead).

    3. Create relation ship between SecurityTable[SalespersonID] to Orders[salespersonid].

    4. Define the RLS Role

    1. Go to Model View → Manage Roles.
    2. Create a new role, e.g., SalesRole.
    3. Apply this filter on the Orders table:
    Orders[salespersonid] IN {
        SELECTCOLUMNS(
            FILTER(SecurityTable, SecurityTable[UserEmail] = USERPRINCIPALNAME()),
            "salesid", SecurityTable[SalespersonID]
        ) }
    ||
    Orders[salespersonid] IN {
        SELECTCOLUMNS(
            FILTER(SecurityTable, SecurityTable[TeamLeadID] = 
                CALCULATE(
                    MAXX(SecurityTable[SalespersonID]),
                    FILTER(SecurityTable, SecurityTable[UserEmail] = USERPRINCIPALNAME())
                )
            ),
            "salesid", SecurityTable[SalespersonID]
        )
    }

    5. Tset RLS: Go to Model View → View As Roles.

    6. After publishing to Power BI Service:

    Go to the dataset settings. Assign real users (email addresses) to the SalesRole defined above.

     

    Thanks,
    If you found this solution helpful, please consider giving it a Like👍 and marking it as Accepted Solution✔. This helps improve visibility for others who may be encountering/facing same questions/issues.

    • powerbiexpert22's avatar
      powerbiexpert22
      Impactful Individual

      Hi ajaybabuinturi ,

       

      I tried mentioned above however i am not getting expected results, please see below screenshots

       

       Security table:

      Orders:

       

      Data Model:

       

       

      Roles:

       

       

       

       

       

       

  • KNP's avatar
    KNP
    Super User

    When you test as other user, you still have to tick SalesRole. 

    See if that helps. 

     

    • powerbiexpert22's avatar
      powerbiexpert22
      Impactful Individual

      Hi KNP ,

      I have tested as SalesRole however it is giving me blank table as shown below

    • powerbiexpert22's avatar
      powerbiexpert22
      Impactful Individual

      Hi KNP ,

      i tired with both option (SalesRole and Other user) , it is giving me expected results however when i tried with team lead id ( [email protected]) it is giving blank table

      • Anonymous's avatar
        Anonymous
        Not applicable

        Hi powerbiexpert22,

         

        Can you please check USERPRINCIPALNAME() matches the email in the Security table exactly.

         

        Regards,

        Vinay Pabbu

  • KNP's avatar
    KNP
    Super User

    When you tested, did you tick BOTH other user with an email filled in AND SalesRole? 

    • Anonymous's avatar
      Anonymous
      Not applicable

      Hi powerbiexpert22,

       

      Since the admin role has no filters and shows all data, this confirms that your data and relationships are set up correctly.

      However, if the team lead’s salesperson IDs in the security table don’t match any salesperson IDs in the orders table, the filtered result will be blank.

       

      Regards,

      Vinay Pabbu

      • powerbiexpert22's avatar
        powerbiexpert22
        Impactful Individual

        Hi Anonymous ,

        i will assign admin role to team lead so that they will see all data