Dynamic RLS and groups

[Peter_23]

Hi there, in this time, I'm working with dynamic RLS so I have a dim_table_security and I'm implemented RLS in 4 diferents roles, admin, country, state, city, with their user principal name, e.g ted@org = US ,  tom@org  =  Kansas ; It's fine. So I'm trsting with roles and username is OK. but in the service It's requiere to apply groups, not user by user. So my question is:  Do it need create one group by role or one group for all roles? 

🤔

thanks

[v-yohua-msft · Accepted solution]

Hi, @Peter_23 

You can create a new security group in your authentication service, such as Azure Active Directory. Create separate groups for each role (e.g., Admin, Country, State, City). Add the appropriate users to the group of the role they belong to. For example, add admin users to the Administrators group, add country level users to the country group, and so on.

Next, in your data model, configure RLS rules based on the group to which the user belongs. You can use DAX expressions in Power BI to define RLS rules to ensure that only users of a specific group have access to the corresponding data.

Publish the configured data model to the Power BI service. Then test whether different groups of users can only access the data they are authorized to.

How to Get Your Question Answered Quickly

Best Regards

Yongkang Hua

If this post helps, then please consider Accept it as the solution to help the other members find it more quickly.

[Kaviraj11]

Hi,

Normally, if you have created one RLS roles then one group for all roles is fine but if you have multiple roles created then create specific group by roles.