How to handle complex RLS requirements?

[radhk0405]

In Power BI, how do you handle exception scenarios for row-level security (RLS)?

For example: Cross department access

Do you create individual security groups for each unique combination of users, or do you use another approach to manage access?

Currently, some teams use a security table that maps users to roles and permissions, which is then joined with the main data table to enforce access rules dynamically. While we also use Azure AD groups, these are quite static, based on department or organizational hierarchy, and aren’t flexible enough to handle exceptions.

Is anyone following a different or more flexible approach for managing complex RLS requirements? If so, I'd appreciate any suggestions or insights on alternative methods.

Dynamic Row Level Security

[Anonymous]

Hi @radhk0405 ,

For finer data access, you can leverage user attributes, such as user names or email addresses, to dynamically filter data. For example, you can add a table containing user information to the data model and associate it with the main table. You can then use a DAX function such as USERPRINCIPALNAME() to obtain information about the current user and apply filters based on this information. For example, you can create a table with department and user's UPN and dynamically generate filters based on this information.

Best regards,

Mengmeng Li

[GilbertQ]

Hi @radhk0405 

If a particular user needs to be across departments, and you have got row level security on a per department access, simply add the user to both departments. Power bi RLS security uses a least privilege access, which means, if a user exists in two departments, they'll be able to take both data and leave the deparments.