Dynamic Row-Level Security (RLS) in Power BI Without Creating Roles

[jsodaram]

I would like to propose a feature enhancement for Power BI that allows for the implementation of Row-Level Security (RLS) without the need to create roles. Currently, RLS in Power BI requires the creation of roles and defining rules to restrict data access. While this approach works well, it can become cumbersome and complex, especially in scenarios with a large number of users and dynamic security requirements.

Proposed Solution: I propose introducing a dynamic RLS feature that leverages user-specific attributes, such as email addresses or user IDs, to filter data without the need to create predefined roles. This could be achieved by using DAX functions like USERPRINCIPALNAME() to dynamically filter data based on the logged-in user.

Benefits:

Simplifies the process of implementing RLS, especially in large organizations.
Reduces the administrative overhead of managing multiple roles.
Enhances flexibility and scalability in managing data security.
Provides a more intuitive and user-friendly approach to data security in Power BI.
Use Case: For example, a sales dashboard could dynamically filter sales data to show only the relevant data for the logged-in salesperson without the need to create individual roles for each salesperson.

I believe this feature would greatly enhance the usability and flexibility of Power BI, making it easier for users to implement and manage data security.

Thank you for considering this idea. I look forward to the community's feedback and support.

[Jake91]

You're half describing how you should currently achieve data-driven dynamic RLS anyway. You will always need some user-SecurityMapping data to describe which user should see which data within a report i.e. John.Doe@mycompany.com can only see Cost Centre: 1234. You could achieve this through appropriately named/tagged Entra Security Groups and have a query that gets all users/groups. You join this SecurityMapping table to the data that should be filtered i.e. SecurityMapping:CostCentre to Sales:CostCentre You then create 1 role "Data-Driven Dynamic" and apply DAX on SecurityMapping.User = USERPRINCIPALNAME() Your SecurityMapping filter then passes through and filters Sales appropriately based on that relationship.