Conditional data masking or something else

[CamFi]

Hi everybody, 

i've been looking for a solution for my problem for quite i while now and haven't been able to find a correct way to do so. i am trying to implement data sercurity masking so everybody is not able to see all data. 

i have a time entries table where all employees work entries are registered. every entry is registered inside a category: Customer time, Internal Time or Sickness.

i am trying to create a sickness report - but some data should be masked depending on which user is looking at the report. the picture below describes how the data should be viewed:

Requirements:

• everybody should be able to see totals and percentage of total
• HR should be able to see everything
• Managers should be able to see detailed data for their own teams
• Employees should only be able to see details of their own data
• the restriction should work in both power BI and when downloading to excel

I've started with a solution based on dynamical RLS with PATHCONTAINS() - the idea behind this dynamical RLS is close, but it deletes the totals and percentages of total which i need  and it do not take into consideration customer time, internal time or sickess. the detailed information should only be masked for sickness, and not for customer time or internal time. 

Hope somebody might know a solution to the above mentioned problem.

cheers.

[V-lianl-msft]

See if this blog can help you:

https://radacad.com/secure-the-sensitive-data-in-power-bi-data-masking-better-with-row-level-securit... 

[CamFi]

Hi @V-lianl-msft,

thank you for the respond. i forgot to mention that i am using a SSAS tabular live connection, and are therefor not able to restrict or manage the roles inside power BI. But i will try to see if this can in someway be implemented into SSAS. 

i am a little worried though to create duplicate tables and was hoping to find another solution.