Dynamic AD Group-Based Row-Level Security (USERMEMBEROF()) in Power BI/Fabric

[psadav]

Hello Microsoft Power BI/Fabric Team and Community,

I am working on a large-scale Power BI solution in a Fabric F64 capacity workspace. My scenario requires dynamic row-level security (RLS) based on Azure AD group membership, as our user base is large and changes frequently. The ideal solution is to use the USERMEMBEROF() DAX function, which would allow us to maintain a simple mapping table of AD groups to data access, without having to manage individual user emails.

Current Situation:

• Our workspace is on Fabric F64 (Premium) capacity.
• The USERMEMBEROF() DAX function is not available in our tenant, and there is no Enhanced Row-Level Security (RLS) toggle in the Admin Portal.
• The only available workaround is to use a user-to-site mapping table with [UserPrincipalName] = USERPRINCIPALNAME(), which is not scalable for our scenario.
• Assigning AD groups to roles in the Service does not enable dynamic filtering, as USERNAME() and USERPRINCIPALNAME() return the user’s email, not group membership.
•  

Request:

• Is there an ETA for general availability of USERMEMBEROF() or Enhanced RLS for all Premium/Fabric tenants?
• Are there any preview programs or tenant settings we can request to enable this feature?
• Is there any recommended scalable workaround for dynamic AD group-based RLS until this feature is available?

This feature is critical for organizations with dynamic, group-based access requirements. Any update or guidance would be greatly appreciated!

Thank you,

[tayloramy]

Hi @psadav, 

Power BI cannot determine AD membership. 

You will need to have a table in your model that can map to the user's email. 

I believe there is an active directory connector so you can pull in your groups as tables, and then from there you should be able to calculate a security table that can map a user's email to the rows they are supposed to see.  

[v-nmadadi-msft]

Hi @psadav   ,
Thanks for reaching out to the Microsoft Fabric Community forum. 

As a workaround, you can implement dynamic RLS by maintaining a separate security mapping table in Power BI that contains the Azure AD groups along with the relevant users assigned to those groups. You can then use the USERPRINCIPALNAME() DAX function to dynamically filter data based on the currently logged-in user. In this approach, the user’s email (returned by USERPRINCIPALNAME()) is matched against the mapping table to determine which group they belong to, and the corresponding access rules are applied. While this still requires maintaining user membership information, it provides a practical and scalable alternative until USERMEMBEROF() or Enhanced RLS becomes generally available.

Dynamic Row-Level Security (RLS) Implementation in... - Microsoft Fabric Community

I hope this information helps. Please do let us know if you have any further queries.
Thank you

[psadav]

Thank you for your response and suggestion.

Unfortunately, maintaining a user-to-email mapping table is not feasible for our scenario. Our organization manages report access exclusively through Azure AD groups, and the user base is large and dynamic—users are frequently added or removed from groups by our IT team, and we do not have visibility or control over individual memberships.

Because of this, adding each user’s email to a mapping table is not practical or scalable for us. We require a solution where row-level security can be enforced dynamically based on AD group membership, without manual user maintenance.

We look forward to the general availability of USERMEMBEROF() or Enhanced Row-Level Security in Power BI/Fabric, as this would fully address our needs. In the meantime, please let us know if there are any preview programs or alternative solutions for dynamic, group-based RLS.

Thank you for your support and understanding.

Best regards,

Prasen.

[lbendlin]

That is not a DAX function. Are you thinking of Powershell?