Forum Discussion
Filtering semantic model for end-consumer
I've moved this entire topic to the Power BI forum as it's more closely related to Power BI specific inquiries and behaviors.
The answer or solution, as previously stated by others, is implementing your own RLS logic. That would make sure that folks only get to access exactly the data that they need to access and nothing more.
How you could implement such RLS logic / policy is something that the Power BI forum would be far better suited than the Dataflow Gen2 forum.
Have you considered using RLS (Row Level Security)?
Yes we have, but for our scenario, I am not sure it can work.
Let's say we have 100 clients, and about 5 teams. We'd create RLS for the 5 teams, but that still means they get to see 20 clients each.
Do you think another approach would be to have 100 clients, each one having it's own O365 group. When adding users to the O365 groups, would they somehow only get to see the data for the specific client? Even when users are added to multiple O365 groups. For example user A would be added to O365 group 1, 2 and 3. Would user A still get to see all items from 1 to 3?
The final step for us, is connecting the data to Excel. So it's very important that user A only gets to see the data for item 1, when we deploy the Excel templates for item 1.
I think the RLS would only work if each user only has access to one client.
So I think if you have 100 clients, you would need a separate user for each client.
(I.e. 100 users).
I'm not a Microsoft 365 administrator so I'm not sure if that is a good approach. But I guess it could be problematic, because it means you would need to create a "dummy user" or "service user" per client, unless you already have a user per client.
I guess creating such "service users" could create governance risks related to authentication. But I don't have enough knowledge on that subject (user account management in organizations) to say something for sure.
So I'm not recommending it.
I'm just saying if you were to use RLS, I guess you would need separate users for each client.
Thank you for your reply.
I also think this problem will occur, I have 100 clients, and also 100 seperate O365 or security groups per client. But I only have about 20 users, that are spread accross the groups. Some users can occur (a lot) more than once in group.
So I think that that one users will still see all the data for the groups he is part of and not just the one we want to show.