Power BI, RLS and bidirectionnal cross-filtering

[Nikill]

Hello,

I'm having issue understanding bidirectionnal cross-filtering. Maybe I'm completely missing the point there but if I could have any explanation that could be great.

I have a RLS defined on one table in a very regular way, think groups like Manager/Accountant/Salesman on a typical employee table 

I want the data for the other tables to be filtered out depending on the user group (for instance if an Accountant is building reports on powerbi.com based on this dataset, I don't want him to be able to see the salary of Salesmen/Managers from the Salary table).

Is bidirectionnal cross-filtering the right answer to this case ? Shall I check this in the relation between my Employee table and my Salary table in the Model ?

Thanks a lot for your inputs,

Cheers,

Nicolas

[Anonymous]

I built a report, applying RLS. one thing have noticed was, on the dimention table where i applied the Security, the security works but the data dont Change as i was expect to filter based on the Security. whilst on the report the slicer work as it should. Please Help

[Anonymous]

HI @Nikill,

For your scenario, I' like to suggest you to setting RLS on group level. (use USERNAME function with relationship to found group role of current user, then apply filter effect on group level)

After these steps, your data will be filtered based on group and their relationships, these unmatched group roles will be hidden.

If you mean your data has multiple level and parent can view its childrens data, I think you need to add condition to check user level before apply group roles filters.

Regards,

Xiaoxin Sheng

[Nikill]

Hi @Anonymous,

Thanks a lot for your answer. 

Indeed I'll use RLS the way you mention it. But my point was more, in the case of an user accessing directly the dataset through the workspace on PowerBI.com and using the web browser to design a report, if this user pulls data from the salary table, he will be able to see all salaries listed until he adds a columns from the Employee table, where the filter will then be instantly applied. 

That raise another question : does the RLS applies when an user (in a certain RLS group) is designing a report from Web Interface ? 

thanks again for your answer,

Nicolas

[Anonymous · Accepted solution]

Hi @Nikill,

>>That raise another question : does the RLS applies when an user (in a certain RLS group) is designing a report from Web Interface ? 

What 'web interface' you mean? Power bi embed or report create on power bi service side?

If you mean RLS with power bi embedded, current it support RLS but you can't edit online.

For report you create online, power bi service not support add or edit RLS, you can only edit on desktop side and assign roles on service side.

Regards,

Xiaoxin Sheng

[Nikill]

Hi @Anonymous, 

I think I am very close to my solution with your answer. 

Indeed, I am speaking of designing reports directly on powerbi.com from a dataset. What I want to know is if the RLS applies on the report the RLS affected user is designing in his browser. It's fine if he can't manage RLS through web as I ertainly don't want him to do that.

Thanks a lot,

Nicolas