Alternatives for Row Level Security to avoid managing the RLS role list

[oemer_erguen]

To summarize my problem: I am looking for a solution, to skip the process of adding each user/security-group/mail-enabled-group to the RLS role.

Because of our company policy I am limited to adding each user individually. Because we have more than 200 people needing to access the report, we need a better solution than manually managing the RLS role list. Are there any alternatives to the RLS? All we need is to dynamically filter a user-group table by their e-mail address.

[Anonymous · Accepted solution]

Hi @oemer_erguen

If you want to filter data based on users, you can only do it through RLS. As @Anonymous mentioned , you can use usernameprinciple() to make the RLS dynamic . To create a dynamic RLS, you can follow the steps below.

1. Filter functions in DAX
2. Create Roles in RLS
3. User Access Management (UAM)
4. UAM with Distribution List
5. Dynamic RLS
6. Filter Direction and Security Filter Direction

I found a few samples for you, you can refer to .

https://radacad.com/dynamic-row-level-security-with-power-bi-made-simple 

https://medium.com/analytics-vidhya/power-bi-row-level-security-and-dynamic-rls-1ee7faaa703e

Best Regards,
Community Support Team _ Ailsa Tao
If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Anonymous]

If you have the user's email address in your dataset, you could use usernameprinciple() to make the RLS dynamic. What usernameprinciple() function does is it compares the email address user used to access the power bi report and if it matches with the email address present in your dataset it will show only those data that the users have access to.

If you need any guidence to implement this dynamic RLS check out this article. Try this and see if it solvs your problem.

[otravers]

You could try using the username/userprincipalname DAX function in combination with a list of user emails being present in your dataset and see if that works. I never tried it in the absence of RLS rules I so I'm not sure it will work though.

[otravers]

What do you mean by "Because of our company policy I am limited to adding each user individually"? Adding to what?

If you have access to your AAD security groups via Graph API or AAD Power Automate connector, then you could query AAD for a dynamic list of users you'd then feed to your RLS rule.

[oemer_erguen]

I can't create security groups for example and even my access is limited. Luckily for me, I was allowed to use the distribution group, which is managed by our company. But I am still wondering if a dynamical filter is possible without using RLS...