DARTS : Row Level Security in Power BI

Row Level Security (RLS) can be used to restrict access to data in a Power BI report based on a user’s Power BI Service login credentials. The RLS has to be set up on each dataset.

Steps

Open your dataset in Power BI Desktop. Select "Manage Roles" under Modeling tab.
Create a new role:
1. Click "Create" and name the role
2. Choose field from the appropriate table
3. Add DAX expression
4. Create all of the roles you need
5. Click "Save"
Publish the dataset to Power BI Service.
On Power BI Service, go to the dataset > three ellipse> Security.
Add member's email address or AD Groups to each roles. (All available emails or groups will show up when you start typing. If you don't see group, please contact DARTS@maine.edu .) Users who are not assigned to Security roles in Power BI Service will be able to see all the data in the model.
Test a role
1. Click the ellipse next to the role
2. Click "Test as role"
3. It will take you to the report page and show the report with the security role.
4. Save the security setting

Using DAX

Staff dimension table with a unique key for each staff member [EMP_ID], including managers, directors, etc.
Each staff member row should contain a value for their direct supervisor [Manager], if exists. Email addresses [Emp_UserPrincipalName] for each staff member should be included in the table.
The Staff table should be joined to relevant employee facts through the unique staff key.

PATH() Function:

Returns a delimited test string with identifiers for all the parents of the current identifier. This will generate the complete organizational hierarchy based on the staff dimension table.
Org Hierarchy =
PATH(Org[EMP_ID],Org[Manager])

PATHITEM() Function:

Returns the item from the specific position from a string resulting from using he PATH() function. This can be used to identify a specific level in the hierarchy.
Org Level 1 =
LOOKUPVALUE('Org'[Emp_UserPrincipalName],
'Org'[EMP_ID],
PATHITEM(Org[Org Hierarchy],1,TEXT)
)

USERPRINCIPALNAME() Function:

Returns the user in the format of their user principal name, i.e. test@maine.edu (email address). To test the role, replace the USERPRINCIPALNAME() function with a hardcoded value.

[UserPrincipalName] = userprincipalname()

HELP IS AT HAND!

Link to compose email for help with website.

Question, comment, critique? We are here to help and we strive to make our site a comprehensive, user friendly experience. Contact us at DARTS@maine.edu.

Other Resources

Microsoft website: Restrict data access with row-level security (RLS) for Power BI Desktop
Microsoft website: Row-level security (RLS) with Power BI
Microsoft website: Row-level security (RLS) guidance in Power BI Desktop
BlueGranite Blog: https://www.blue-granite.com/blog/using-dynamic-row-level-security-with-organizational-hierarchies
Guy in a Cube video: