Row-level security (RLS) with Power BI Desktop
Row-level security (RLS) with Power BI Desktop restricts data access for given users. Filters restrict data at the row level. You can define filters within roles.
You can now configure RLS for data models imported into Power BI with Power BI Desktop. You can also configure RLS on datasets that are using DirectQuery, such as SQL Server. Previously, you were only able to implement RLS within on-premises Analysis Services models outside of Power BI. For Analysis Services live connections, you configure Row-level security on the on-premises model. The security option does not show up for live connection datasets.
If you defined roles and rules within the Power BI service, you will need to recreate those roles within Power BI Desktop and publish the report to the service.
Learn more about options for RLS within the Power BI Service.
Define roles and rules in Power BI Desktop
You can define roles and rules within Power BI Desktop. When you publish to Power BI, it also publishes the role definitions.
To define security roles, follow these steps.
Import data into your Power BI Desktop report, or configure a DirectQuery connection.
You can't define roles within Power BI Desktop for Analysis Services live connections. You need to do that within the Analysis Services model.
Select the Modeling tab.
Select Manage Roles.
Provide a name for the role.
Select the table that you want to apply a DAX rule.
Enter the DAX expressions. This expression should return a true or false. For example: [Entity ID] = “Value”.
You can use username() within this expression. Be aware that username() has the format of DOMAIN\username within Power BI Desktop. Within the Power BI service and Power BI Report Server, it's in the format of the user's User Principal Name (UPN). Alternatively, you can use userprincipalname(), which always returns the user in the format of their user principal name, *firstname.lastname@example.org*.
After you have created the DAX expression, you can select the check above the expression box to validate the expression.
You can't assign users to a role within Power BI Desktop. You assign them in the Power BI service. You can enable dynamic security within Power BI Desktop by making use of the username() or userprincipalname() DAX functions and having the proper relationships configured.
Validate the roles within Power BI Desktop
After you've created your roles, test the results of the roles within Power BI Desktop.
Select View As Roles.
In View as roles, you see the roles you've created.
Select a role you created > OK to apply that role. The report renders the data relevant for that role.
You can also select Other user and supply a given user. It's best to supply the User Principal Name (UPN) as that's what the Power BI service and Power BI Report Server use.
Select OK and the report renders based on what that user can see.
Within Power BI Desktop, Other user only displays different results if you're using dynamic security based on your DAX expressions.
Following is a list of the current limitations for row-level security on cloud models.
If you previously defined roles and rules in the Power BI service, you must re-create them in Power BI Desktop.
You can define RLS only on the datasets created with Power BI Desktop. If you want to enable RLS for datasets created with Excel, you must convert your files into Power BI Desktop (PBIX) files first. Learn more
Only ETL and DirectQuery connections are supported. Live connections to Analysis Services are handled in the on-premises model.
Cortana is not supported with RLS at this time.
There is a known issue where you'll get an error message if you try to publish a previously published report from Power BI Desktop. The scenario is as follows.
Anna has a dataset that is published to the Power BI service and has configured RLS.
Anna updates the report in Power BI Desktop and republishes.
Anna receives an error.
Workaround: Republish the Power BI Desktop file from the Power BI service until this issue is resolved. You can do that by selecting Get Data > Files.
Question: What if I had previously created roles and rules for a dataset in the Power BI service? Will they still work if I do nothing?
Answer: No. Visuals will not render properly. You will have to re-create the roles and rules within Power BI Desktop and then publish to the Power BI service.
Question: Can I create these roles for Analysis Services data sources?
Answer: You can if you imported the data into Power BI Desktop. If you are using a live connection, you will not be able to configure RLS within the Power BI service. This is defined within the Analysis Services model on-premises.
Question: Can I use RLS to limit the columns or measures accessible by my users?
Answer: No. If a user has access to a particular row of data, they can see all the columns of data for that row.
Question: Does RLS let me hide detailed data but give access to data summarized in visuals?
Answer: No, you secure individual rows of data but users can always see either the details or the summarized data.
More questions? Try asking the Power BI Community
We'd love to hear your thoughts. Choose the type you'd like to provide:
Our feedback system is built on GitHub Issues. Read more on our blog.