Ravindra BagaleCourses & study guides मराठी Track your progress

26. Row-Level Security (RLS)

Power BI Dynamic RLS Practice with Answer Key

Suppose we are sending the Blinkit Maharashtra report to three managers. Use the six orders from the DAX practice (13: Practice and Answer Key) plus this table (fictional e-mails).

User Security

Email City
ravindra.bagale@example.com Pune
shraddha.bagale@example.com Nashik
ravina@example.com Pune
ravina@example.com Mumbai

Exercise (one under the other):

  1. Enter User Security with Home › Enter data. Do not relate it to anything.
  2. Modeling › Manage roles › New. Name: City Manager. Table: Orders (in this tiny model City is on Orders).
  3. Paste the rule from the answer key. Save.
  4. Modeling › View as › tick Other user › type each e-mail › tick City Manager.
  5. Write down the Total Sales card for each user.

Expected result:

View as (Other user) Cities visible Total Sales card
ravindra.bagale@example.com Pune ₹600
shraddha.bagale@example.com Nashik ₹300
ravina@example.com Pune, Mumbai ₹1,700
new.user@example.com none (blank)
Answer key (open after you try)
[City]
    IN CALCULATETABLE(
        VALUES('User Security'[City]),
        'User Security'[Email] = USERPRINCIPALNAME()
    )

Ravina: Pune ₹600 + Mumbai ₹1,100 = ₹1,700. A user with no row in User Security sees nothing. In the real model put the role on DarkStore so the filter flows to Orders.

Common mistakes:

What you see Why Fix
Manager sees all cities in the Service She is Admin, Member or Contributor in the workspace Give Viewer role or app access
Manager sees nothing Her sign-in name (UPN) is an alias or old domain, or the cell has extra spaces Show USERPRINCIPALNAME() in a card while testing; trim the table
Role works in Desktop, not in the Service Members not added Semantic model › Security › add users or a group to the role
You tested only one user Bugs hide in multi-city users and unknown users Test one single-city, one multi-city and one unknown user

Samajla ka? Test three people: one city, two cities, and nobody. If all three are right, the role is right.

Thodkyaat sangaycha tar (quick recap)

Static RLS is a fixed rule; dynamic RLS is USERPRINCIPALNAME plus a security table. Test with View as, and remember: RLS does not apply to Admin, Member or Contributor. Now let us move on to performance.