API for adding/removing users to RLS Security and Dashboard access

[anotefler]

Hello dear PBI Community,

in our quite big company we have a dashboard (based on PBI) which is very popular in the organization and provides a lot of data to the users. The users should not see all data so we use OLS (only specific columns), RLS (only specific rows), PLS (only specific pages) to ensure that the users only see the data which their role requires. As you know there are three spots to add new users (as seen in the screenshot below). For us the process of adding new / removing users is very annoying as this changes quite frequently.

We have a SQL Server, which provides the respective data tables but also the security table which is used to filter the relevant data down to the individual users. We found one API Endpoint but this one only allows to add/remove users in second spot (semantic model access): Datasets - Put Dataset User In Group - REST API

Therefore my question is this:

Is it really like this there is no other API endpoint to add(/remove) also users to "Dashboard access" and to "RLS/Security"? Or what are you guys are using to do this automatically in a corporate setting? Doing this manually is very annoying and takes a lot of effort.

Thank you very much!

- We also tried to experiment with Distribution Lists using power automate but the Entra connector is not allowed to be used by our Corp Security team. Is there any other way to maybe add / remove users per API to PowerBI or at least a distribution list? We also dont want to add a big company distribution list that includes all employees, so we have a double layer of protection

- We also though noticed that we could use the Microsoft Teams channels but we dont want that users get a notification on being added to Teams, so also this option is out.

[v-achippa]

Hi @anotefler,

Thank you for reaching out to Microsoft Fabric Community.

Currently there is no supported API to add or remove users from RLS roles, and dashboards do not have an independent security beyond workspace and semantic model permissions.
The recommended enterprise way is to use dynamic RLS using a central security table(for example in sql) and manage access through Entra ID security groups at the workspace or dataset level. User onboarding and offboarding should be handled by updating group membership or the security table, not by modifying power bi objects directly.

Thanks and regards,

Anjan Kumar Chippa