Forum Discussion

psadav's avatar
psadav
Frequent Visitor
2 months ago
Solved

Dynamic AD Group-Based Row-Level Security (USERMEMBEROF()) in Power BI/Fabric

Hello Microsoft Power BI/Fabric Team and Community,   I am working on a large-scale Power BI solution in a Fabric F64 capacity workspace. My scenario requires dynamic row-level security (RLS) based...
General Comment
Tips and Tricks
Tutorial Requests
  • v-nmadadi-msft's avatar
    v-nmadadi-msft
    2 months ago

    Hi psadav ,
    If the requested feature is important for your functionality Please consider sharing your suggestion in the Power BI Ideas forum.
    Fabric Ideas - Microsoft Fabric Community
    where the product team actively monitors user feedback. Ideas with strong community support are more likely to be considered for future implementation. Posting there helps ensure your request reaches the right audience and contributes to shaping the product roadmap.
    Regards

v-nmadadi-msft's avatar
v-nmadadi-msft
Community Support
2 months ago

Hi psadav   ,
Thanks for reaching out to the Microsoft Fabric Community forum. 

As a workaround, you can implement dynamic RLS by maintaining a separate security mapping table in Power BI that contains the Azure AD groups along with the relevant users assigned to those groups. You can then use the USERPRINCIPALNAME() DAX function to dynamically filter data based on the currently logged-in user. In this approach, the user’s email (returned by USERPRINCIPALNAME()) is matched against the mapping table to determine which group they belong to, and the corresponding access rules are applied. While this still requires maintaining user membership information, it provides a practical and scalable alternative until USERMEMBEROF() or Enhanced RLS becomes generally available.

Dynamic Row-Level Security (RLS) Implementation in... - Microsoft Fabric Community

I hope this information helps. Please do let us know if you have any further queries.
Thank you

psadav's avatar
psadav
Frequent Visitor
2 months ago

Thank you for your response and suggestion.

 

Unfortunately, maintaining a user-to-email mapping table is not feasible for our scenario. Our organization manages report access exclusively through Azure AD groups, and the user base is large and dynamic—users are frequently added or removed from groups by our IT team, and we do not have visibility or control over individual memberships.

 

Because of this, adding each user’s email to a mapping table is not practical or scalable for us. We require a solution where row-level security can be enforced dynamically based on AD group membership, without manual user maintenance.

 

We look forward to the general availability of USERMEMBEROF() or Enhanced Row-Level Security in Power BI/Fabric, as this would fully address our needs. In the meantime, please let us know if there are any preview programs or alternative solutions for dynamic, group-based RLS.

 

Thank you for your support and understanding.

 

Best regards,

Prasen.

  • v-nmadadi-msft's avatar
    v-nmadadi-msft
    Community Support
    2 months ago

    Hi psadav ,
    If the requested feature is important for your functionality Please consider sharing your suggestion in the Power BI Ideas forum.
    Fabric Ideas - Microsoft Fabric Community
    where the product team actively monitors user feedback. Ideas with strong community support are more likely to be considered for future implementation. Posting there helps ensure your request reaches the right audience and contributes to shaping the product roadmap.
    Regards