Power BI Blog: Row-Level Security (RLS) – Part 1

Welcome back to this week’s edition of the Power BI
blog series.  This week, we look at static row-level security (RLS) in
Power BI Desktop.

One of the
key features that distinguishes Power BI from other Business Intelligence (BI) solutions
is its ability to provide row-level security (RLS), which is protection based upon
each row of a data table.  Instead of
creating a report for each of the access profiles, you can create a single
report linked to different access profiles. 
Essentially, you may specify rules (e.g. Country = “Australia”)
that filter the data that a user can see within their reports.  For instance, a General Manager may access data
that is available within their division only, whereas a CEO may have
unrestricted access to the entire dataset. 

Power BI
essentially displays the same report to all users but restricts the data flow
through to the report based on the security settings. 

You should
note that RLS may be set up for data models imported into Power BI using Power
BI Desktop.  RLS may also be configured
on Direct Query datasets such as SQL Server. 
 

Defining
Roles and Rules in Power BI Desktop – Static

In this
example, we will set up a security option that would restrict a Manager in
Australia to only be able to view data from Australia.  First, we must define the security role.  To do this, we need to go to the Modeling (sic)tab, and in the Security group, click on ‘Manage roles’.  

This will bring up a dialog, which will
allow us to create and define roles within our dataset.  Let’s create a new role and name it ‘Australian
Managers’.  We begin by clicking the
Create button.  

Once we have entered a name for the role
under Roles, we can begin adding filters. 
In the second column, Tables, click the ellipsis (‘…’) next to Geography,
mouse over ‘Add Filter…’ and then select [EnglishCountry].  The ‘Table filter DAX expression’ is
presented on the right-hand side, which allows us to create a DAX expression
that must evaluate to ‘True’ before the data can be accessed by this role.  

When you have finished creating the role, click the checkbox above the
expression box to validate it. 
Afterwards, press the Save button and the filter(s) created will be applied to the specific
role(s). 

Validating Roles within Power BI Desktop – Static

With our
new role created, we can check that everything has worked as intended and that the
members of the role see the correct data. 
On the Modeling tab, clicking ‘View as’, which opens a pop-up window where
you can see the roles you have created.  Within this window, you may tick a role to
preview what that role would see.  

The ‘Other
user’ option in Power BI Desktop will only display a different view if you’ve
employed dynamic security. 

With the
‘Australian Managers’ role applied, the entire report is filtered to only
display data for Australia.  A yellow bar
will be displayed at the top of the report, informing the user that the report
is being viewed as ‘Australian Managers’. 
To stop viewing this filter, click on the ‘Stop viewing’ button on the
top right-hand side and it will return to the full view.  

It should
be emphasised that this functionality only applies to the Power BI online
services, i.e. once data has been published and distributed online then row-level
security may be employed. 

There is no
security in the PBIX file; you can see the entire dataset.  There is no way that you may have any
security with Power BI Desktop files and roles may only be created or modified
inside Power BI Desktop. 

Next time, we will
continue by looking at static security through RLS in Power BI Service.

Check back next week for more Power BI tips
and tricks!