What is Row-Level Security (RLS)?

Row-Level Security (RLS) is a Power BI feature that restricts which rows of data a user can see, based on their identity or assigned role. It enables multi-tenant reports where one report serves many audiences, each seeing only their authorized data.

The Problem RLS Solves

Without RLS: • Create separate reports for each region/team/department • Manually filter data before sharing • Risk of data leaks when sharing unfiltered reports

With RLS: • One report serves all users • Each user automatically sees only their authorized data • Security is enforced at the data model level — cannot be bypassed by users

RLS Architecture

User logs in → Power BI checks role assignment →
DAX filter applied to data model → Only matching rows visible

Components of RLS

Types of RLS

1. Static RLS

Roles have hardcoded filter values. You create a separate role for each group.

Example:

Role: "East Region"
Filter: [Region] = "East"

Role: "West Region"
Filter: [Region] = "West"

Pros: Simple to set up Cons: Doesn't scale — need a new role for every region/department

2. Dynamic RLS

Uses the logged-in user's identity to filter data dynamically. No need to create individual roles.

Example:

Role: "Sales Rep"
Filter: [SalesRepEmail] = USERPRINCIPALNAME()

How It Works:

1. Your data table has a column with user identifiers (email addresses)
2. The DAX filter uses USERPRINCIPALNAME() to match the current user
3. Each user automatically sees only their own rows

Pros: Scales to any number of users Cons: Requires user identity column in data; more complex setup

When to Use Each Type

RLS Limitations

• Does not apply to workspace Admins or Members — they always see all data • Does not filter the data model in Power BI Desktop (only in Service) • Cannot restrict columns — only rows (use OLS for column security) • Performance impact — complex DAX filters can slow down report loading • Maximum of 512 roles per dataset