Row-Level Security (RLS) in Power BI Service

Row-Level Security (RLS) restricts data access at the row level — different users see different rows of data based on their identity or role.

Why Use RLS?

• Data security — ensure users only see data they're authorized to view • Single report, multiple audiences — one report serves all users, each seeing their own data • Compliance — meet regulatory requirements for data access control • Efficiency — no need to create separate reports for each team/region

How RLS Works

1. Define roles in Power BI Desktop with DAX filter expressions
2. Assign users to roles in Power BI Service
3. When a user opens the report, only matching rows are visible

Example Scenario

Requirement: Regional sales managers should only see data for their region.

Sales Table:

RLS Role: "East Region" DAX Filter: [Region] = "East"

Result: A user assigned to "East Region" only sees Alice and Charlie's rows.

Setting Up RLS — Step by Step

Step 1: Define Roles in Desktop

1. Open Power BI Desktop
2. Go to Modeling → Manage Roles
3. Click Create → Name the role (e.g., "East Region")
4. Select a table → Add a DAX filter expression:

[Region] = "East"

5. Click ✅ (checkmark) → Save

Step 2: Test in Desktop

1. Go to Modeling → View as Roles
2. Select the role to test
3. Verify that only the expected data is visible
4. Click Stop viewing to return to normal view

Step 3: Publish to Service

1. Publish the report to Power BI Service as usual

Step 4: Assign Users in Service

1. In Power BI Service → Navigate to the dataset
2. Click ••• → Security
3. Select a role → Add users or security groups
4. Click Add → Save

Testing RLS in Service

1. In the dataset security settings → Click ••• next to a role
2. Select Test as role
3. The report opens showing only the data visible to that role
4. Verify correctness

Key Concepts

RLS Does NOT Apply To

• The report creator/workspace admin (they always see all data) • Users with Admin role in the workspace • Direct dataset access via Analyze in Excel (unless RLS is configured)