Power BI Dynamic RLS Practice with Answer Key
Suppose we are sending the Blinkit Maharashtra report to three managers. Use the six orders from the DAX practice (13: Practice and Answer Key) plus this table (fictional e-mails).
User Security
| City | |
|---|---|
| ravindra.bagale@example.com | Pune |
| shraddha.bagale@example.com | Nashik |
| ravina@example.com | Pune |
| ravina@example.com | Mumbai |
Exercise (one under the other):
- Enter User Security with Home › Enter data. Do not relate it to anything.
- Modeling › Manage roles › New. Name:
City Manager. Table: Orders (in this tiny model City is on Orders). - Paste the rule from the answer key. Save.
- Modeling › View as › tick Other user › type each e-mail › tick City Manager.
- Write down the Total Sales card for each user.
Expected result:
| View as (Other user) | Cities visible | Total Sales card |
|---|---|---|
| ravindra.bagale@example.com | Pune | ₹600 |
| shraddha.bagale@example.com | Nashik | ₹300 |
| ravina@example.com | Pune, Mumbai | ₹1,700 |
| new.user@example.com | none | (blank) |
Answer key (open after you try)
[City]
IN CALCULATETABLE(
VALUES('User Security'[City]),
'User Security'[Email] = USERPRINCIPALNAME()
)
Ravina: Pune ₹600 + Mumbai ₹1,100 = ₹1,700. A user with no row in User Security sees nothing. In the real model put the role on DarkStore so the filter flows to Orders.
Common mistakes:
| What you see | Why | Fix |
|---|---|---|
| Manager sees all cities in the Service | She is Admin, Member or Contributor in the workspace | Give Viewer role or app access |
| Manager sees nothing | Her sign-in name (UPN) is an alias or old domain, or the cell has extra spaces | Show USERPRINCIPALNAME() in a card while testing; trim the table |
| Role works in Desktop, not in the Service | Members not added | Semantic model › Security › add users or a group to the role |
| You tested only one user | Bugs hide in multi-city users and unknown users | Test one single-city, one multi-city and one unknown user |
Samajla ka? Test three people: one city, two cities, and nobody. If all three are right, the role is right.
Thodkyaat sangaycha tar (quick recap)
Static RLS is a fixed rule; dynamic RLS is USERPRINCIPALNAME plus a security table. Test with View as, and remember: RLS does not apply to Admin, Member or Contributor. Now let us move on to performance.
Static RLS म्हणजे fixed rule, dynamic RLS म्हणजे USERPRINCIPALNAME आणि security table; View as ने test करा; आणि लक्षात ठेवा, RLS Admin/Member/Contributor ला लागू होत नाही. आता पुढे जाऊया performance कडे.
Static RLS यानी fixed rule, dynamic RLS यानी USERPRINCIPALNAME और security table; View as से test कीजिए; और याद रखिए, RLS Admin/Member/Contributor पर लागू नहीं होता. अब आगे बढ़ते हैं performance की ओर.