Forum Discussion
Implement Dynamic RLS with Azure Security Group
Hi InsightsByV
Thank you for reaching out to the Microsoft Fabric Community Forum.
Power BI Row-Level Security (RLS) requires a defined relationship in your data model to filter data using Azure Active Directory (AAD) group memberships. Power BI cannot dynamically check group memberships within DAX at runtime.
As rohit1991 mentioned, you can automate the extraction of user-to-group membership data from Azure AD with Microsoft Graph API or PowerShell scripts. Store this mapping in a refreshable source like a SharePoint List, Azure SQL Database, or a Dataflow in Microsoft Fabric to keep it updated as your organization changes.
The user-group mapping table should include at least UserPrincipalName and GroupName columns. You can join this table with your RLS permissions table on GroupName to build the necessary relationship. In Power BI Desktop, set up RLS by creating a DAX filter in Manage Roles, such as [UserPrincipalName] = USERPRINCIPALNAME(), on the mapping table.
With this setup, when a user accesses the report, RLS will filter the data to show only what is relevant to the security groups the user belongs to, based on the pre-loaded mapping.
I hope this information is helpful. If this does not helps please share more details so we can assist you further.
Regards,
Karpurapu D,
Microsoft Fabric Community Support Team.
Hi InsightsByV
To apply dynamic RLS with Azure Security Groups using minimal manual effort, create a table mapping each user email to their security group name. You can extract this from Azure AD using PowerShell or Graph API. Load the table into your model and connect it to your RLS table using group name. In the Manage Roles section, use USERPRINCIPALNAME without brackets to match the current user email with the mapping table. Since Power BI does not directly detect group membership, this method helps simulate it without hardcoding users or maintaining large CSVs.