Forum Discussion
Power BI Apps and Reports Dynamic RLS
Hi. I don't think you can get rid of all manual interaction. However you can reduce it. I usually create AD Groups for this. All users in the same role can be added in a group. That way you can add the group to RLS rules in service and add the group to the App sharing.
Now the manangement can be done by IT team. New member in AD, add it to the group and everything will be shared and with the permission required. You can centralize the configuration in a single group if you make it that way.
I hope that helps,
Hi dnsnikul
It looks like you've actually configured what is called "static" RLS.
In your role, on the Table, you have something like [security] = "yes" This means that any user who has that role will only see rows where the column [security] contains "yes".
You are right that in this case you have to add each user to the role to have it apply to them.
You could add a Distribution Group, Security Group or Mail-enabled Group to the role. Then you'll need to add the users to the group you've used each time you want to add or subtract a users from the security role. Then you don't need to go into Power BI to change the secirity, just change the group.
Alternatively, you could use "dynamic" RLS. This is where the security role says something like [Security] = USERPRINCIPALNAME() and is assigned to everyone. This means that the rows are made visible for users where the column [security] matches their Power BI login name (for example "[email protected]" ).
This is very powerful as it places the security in the data, rather than in Power BI. To change security you change the data and refresh the Power BI dataset rather than going into Power BI and adding users to the role. The DAX in the Table Filler DAX expression can be used to implement all manner of security solutions.
See Dynamic Row Level Security with Power BI Made Simple - RADACAD
Hope this helps
Stuart
Thanks, but you misunderstood, I already use dynamic RLS with USERPRINCIPALNAME (), everything works well. My question is how not to constantly add users to my role in which dynamic RLS is running
Well, like ibarrau I'd just have one AD group with everyone in it, and assign that to the dynamic role in Power BI. I think that's your only option.
Stuart
