Dynamic Object-Level Security (OLS)

[HowardTaylor]

Is anyone implementing a dynamic approach for maintaining Object-Level Security (OLS) in Power BI where OLS definitions can stay aligned with source-system RBAC (for example, a data platform or warehouse entitlement model)?

Specifically, I’m curious what patterns people have used for automating OLS updates—such as TMDL, XMLA with TOM/TMSL or Tabular Editor, or triggering model updates through pipelines or CI/CD workflows—to keep security metadata in sync without manual edits.

[v-echaithra]

Hi @HowardTaylor ,

Thank you for reaching out to Microsoft Communtiy.

Like row-level security (RLS), OLS is also defined within model roles. Currently, you can't create OLS definitions natively in Power BI Desktop. To create roles on Power BI Desktop semantic models, use external tools such as Tabular Editor.

Common patterns include:

XMLA automation (Premium / PPU): Using the XMLA endpoint with TOM/TMSL to programmatically create or update roles and OLS definitions based on external entitlement data.

Tabular Editor scripting: Generating OLS metadata from a source system (DB/JSON/Git) and deploying it via Tabular Editor (desktop or CLI).

CI/CD pipelines: Integrating OLS updates into Azure DevOps or GitHub Actions pipelines, typically triggered by entitlement changes or scheduled deployments.

TMDL / model as code: Managing roles and OLS in TMDL and redeploying the model when RBAC metadata changes.

In all cases, the “dynamic” behavior comes from automated redeployment of security metadata, not dynamic evaluation at query time. This is the standard, supported approach customers use today to keep Power BI OLS in sync with source-system RBAC.

Regards,
Chaithra E.