RLS usage in PowerBI - Optimization

[JothyGanesan]

We are using PowerBI dashboard, This runs over the DLT tables in databricks. The access restriction is done using the ROW filter option in databricks. The volumes are huge and hence the power BI queries are running in direct query mode.

We have geography filter using the row filter. Depending on the entra id of the user the row filter on databricks works and gives the data. With direct query will this impact the overal processing?

[cengizhanarslan · Accepted solution]

Yes it can impact performance, and with DirectQuery you’ll feel it immediately, because every visual interaction sends queries back to Databricks, and the row filter is applied on every query.

If your Databricks row filter depends on CURRENT_USER() / Entra ID mapping, the engine often can’t reuse results across users, so you get:

• less cache reuse

• more time spent evaluating security predicates

• more expensive scans/joins if the filter is not highly selective

It’s usually fine if the security filter is selective (cuts data down early) and your tables are designed for it (partitioning / clustering on geography keys, good file sizes, stats). It becomes slow when the filter is complex or applied late (e.g., after joins), or when it forces the query into less optimal plans.

What to watch / do:

• Make sure the filter column (geography key) is a strong pruning column (partition/cluster it).

• Prefer filtering on a simple key (RegionID) rather than text fields.

• Keep the security mapping table small and broadcast-friendly.

• In Power BI, avoid “chatty” visuals (high-cardinality breakdowns) and reduce cross-filtering where possible.

[v-menakakota]

Hi @JothyGanesan ,

Thanks for reaching out to the Microsoft fabric community forum. 

I would also take a moment to thank @cengizhanarslan  and @JothyGanesan   , for actively participating in the community forum and for the solutions you’ve been sharing in the community forum. Your contributions make a real difference.

I hope the above details help you fix the issue. If you still have any questions or need more help, feel free to reach out. We’re always here to support you .

Best Regards, 
Community Support Team  

[rohit1991]

Hii @JothyGanesan 

With DirectQuery, the row-level security defined in Databricks (row filters / Unity Catalog) is applied at query time for every user. Power BI simply passes the user context (Entra ID) to Databricks, and Databricks enforces the filter before returning data. This means performance does depend on the RLS filter, but it does not add extra overhead in Power BI itself. To keep performance optimal, ensure the RLS columns are well-partitioned, indexed, and included in Databricks optimizations (Z-ORDER, caching). Databricks-side RLS is the recommended and scalable approach for large DirectQuery models.