← Back to Chapters

Row Level Security (RLS)

? Row Level Security (RLS) in Power BI

✨ Quick Overview

Row Level Security (RLS) is used to control data access so that users see only the rows they are allowed to see.   It is a critical feature for secure dashboards used by managers, regional heads, and teams.

? Key Concepts

  • Restricts data at row level
  • Based on user login (email ID)
  • Implemented using DAX filters
  • Configured in Power BI Desktop
  • Enforced in Power BI Service

? Syntax / Theory

RLS = Table Filter + User Identity   Power BI evaluates RLS before showing any visual

? Sample Data Used

? View Code Example
// Sales data with region ownership
Region,Sales,ManagerEmail
West,150000,west.manager@company.com
North,120000,north.manager@company.com
South,90000,south.manager@company.com

? Step 1: Create Role

? View Code Example
// Path to create RLS role
Modeling → Manage Roles → Create

? Step 2: Write RLS DAX Filter

? View Code Example
// Filter rows based on logged-in user
Sales[ManagerEmail] = USERPRINCIPALNAME()

? Step 3: Test Role in Desktop

? View Code Example
// Test RLS before publishing
Modeling → View As → Select Role
You will see only rows allowed for the selected role.

? Step 4: Publish & Assign Users

? View Code Example
// Assign users in Power BI Service
Dataset → Security → Add User Email

? Live Output / Explanation

West Manager sees only West data   North Manager sees only North data   Admin sees full data

? Interactive Example (Conceptual)

User Login → Power BI checks role → Filters rows → Shows visuals   This happens automatically without user action

? Use Cases

  • Region-wise sales dashboards
  • Department-wise HR reports
  • Finance reports by cost center
  • Client-specific reports
  • Secure multi-user dashboards

?️ RLS "View As" Simulator

Select a user identity to see how the data table is filtered automatically by Power BI.

Current USERPRINCIPALNAME(): admin@company.com
Region Sales Manager Email

? Tips & Best Practices

  • Always test RLS before publishing
  • Use USERPRINCIPALNAME for dynamic security
  • Keep RLS logic simple
  • Document roles clearly
  • Limit admin access

? Try It Yourself

  1. Create a Sales table with Region & Email
  2. Create a role
  3. Apply USERPRINCIPALNAME filter
  4. Test using View As
  5. Publish and assign users